Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 05:49
Behavioral task
behavioral1
Sample
ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe
-
Size
86KB
-
MD5
ea2d40381b1c68070db71dadd170eff1
-
SHA1
5f53767f22319bc717fe9f2fd81d737fa8855e99
-
SHA256
89fb932451a6666919926ca0255d9e250d1f53f3b3c9d9e3f5b770e9aa490be7
-
SHA512
fa136b674a542fa7e326edca01a182cc051cd9503af6a02ca61efa760af2eceac6446d98d9f1471291b265d6d3c325ed9278d0afe5d6800ad78ba253e737ecd0
-
SSDEEP
768:78Jqh2/DRlS2R2Q8ExPtsTNXfmW/uDs8jr3333333rl3l8IkNxqTkm580oocyZ4i:FhqzJFCNvmWGDjSpT8ZT4wrpDG3mR
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modiloader family
-
ModiLoader Second Stage 19 IoCs
resource yara_rule behavioral2/memory/3868-6-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/952-11-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/3956-19-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4612-25-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4992-32-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/3932-36-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4832-38-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/1780-42-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4712-44-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/1700-47-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4868-50-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4912-53-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/2064-57-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4456-59-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4592-63-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4872-66-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/3100-69-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/4348-71-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 behavioral2/memory/428-74-0x0000000020000000-0x000000002001D000-memory.dmp modiloader_stage2 -
Suspicious use of SetThreadContext 64 IoCs
description pid Process procid_target PID 3868 set thread context of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 952 set thread context of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 3956 set thread context of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 4612 set thread context of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 4992 set thread context of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 3932 set thread context of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 4832 set thread context of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 1780 set thread context of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 4712 set thread context of 628 4712 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 98 PID 1700 set thread context of 2744 1700 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 100 PID 4868 set thread context of 3720 4868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 102 PID 4912 set thread context of 3080 4912 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 104 PID 2064 set thread context of 4960 2064 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 106 PID 4456 set thread context of 3660 4456 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 108 PID 4592 set thread context of 824 4592 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 110 PID 4872 set thread context of 3676 4872 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 112 PID 3100 set thread context of 4576 3100 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 114 PID 4348 set thread context of 4024 4348 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 116 PID 428 set thread context of 4964 428 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 118 PID 4344 set thread context of 4808 4344 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 120 PID 1364 set thread context of 548 1364 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 122 PID 2528 set thread context of 3668 2528 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 124 PID 4056 set thread context of 436 4056 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 126 PID 3092 set thread context of 888 3092 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 128 PID 1204 set thread context of 1656 1204 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 130 PID 3360 set thread context of 1900 3360 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 132 PID 5056 set thread context of 3180 5056 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 134 PID 2736 set thread context of 5100 2736 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 136 PID 1896 set thread context of 4824 1896 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 138 PID 3356 set thread context of 772 3356 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 140 PID 2152 set thread context of 3380 2152 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 142 PID 4408 set thread context of 4764 4408 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 144 PID 1196 set thread context of 1968 1196 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 146 PID 1476 set thread context of 3456 1476 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 148 PID 2012 set thread context of 3940 2012 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 150 PID 1084 set thread context of 3216 1084 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 152 PID 3868 set thread context of 1940 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 154 PID 4212 set thread context of 4052 4212 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 156 PID 3976 set thread context of 116 3976 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 158 PID 2324 set thread context of 1848 2324 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 160 PID 4608 set thread context of 4768 4608 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 162 PID 704 set thread context of 3528 704 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 164 PID 1696 set thread context of 3680 1696 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 166 PID 1108 set thread context of 2920 1108 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 168 PID 4304 set thread context of 852 4304 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 170 PID 2336 set thread context of 4700 2336 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 172 PID 3712 set thread context of 452 3712 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 174 PID 1536 set thread context of 1700 1536 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 176 PID 3188 set thread context of 2812 3188 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 178 PID 640 set thread context of 4912 640 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 180 PID 3248 set thread context of 2064 3248 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 182 PID 816 set thread context of 1020 816 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 184 PID 1564 set thread context of 4584 1564 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 186 PID 5060 set thread context of 752 5060 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 188 PID 3676 set thread context of 3656 3676 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 190 PID 456 set thread context of 4272 456 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 192 PID 3128 set thread context of 4412 3128 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 194 PID 4792 set thread context of 5052 4792 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 196 PID 1580 set thread context of 4428 1580 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 198 PID 1324 set thread context of 4856 1324 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 200 PID 3672 set thread context of 1444 3672 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 202 PID 2244 set thread context of 716 2244 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 204 PID 2848 set thread context of 1556 2848 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 206 PID 2616 set thread context of 3096 2616 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 208 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 3868 wrote to memory of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 3868 wrote to memory of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 3868 wrote to memory of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 3868 wrote to memory of 3928 3868 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 82 PID 3928 wrote to memory of 952 3928 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 83 PID 3928 wrote to memory of 952 3928 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 83 PID 3928 wrote to memory of 952 3928 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 83 PID 952 wrote to memory of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 952 wrote to memory of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 952 wrote to memory of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 952 wrote to memory of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 952 wrote to memory of 116 952 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 84 PID 116 wrote to memory of 3956 116 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 85 PID 116 wrote to memory of 3956 116 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 85 PID 116 wrote to memory of 3956 116 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 85 PID 3956 wrote to memory of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 3956 wrote to memory of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 3956 wrote to memory of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 3956 wrote to memory of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 3956 wrote to memory of 992 3956 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 86 PID 992 wrote to memory of 4612 992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 87 PID 992 wrote to memory of 4612 992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 87 PID 992 wrote to memory of 4612 992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 87 PID 4612 wrote to memory of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 4612 wrote to memory of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 4612 wrote to memory of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 4612 wrote to memory of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 4612 wrote to memory of 3740 4612 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 88 PID 3740 wrote to memory of 4992 3740 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 89 PID 3740 wrote to memory of 4992 3740 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 89 PID 3740 wrote to memory of 4992 3740 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 89 PID 4992 wrote to memory of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 4992 wrote to memory of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 4992 wrote to memory of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 4992 wrote to memory of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 4992 wrote to memory of 4736 4992 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 90 PID 4736 wrote to memory of 3932 4736 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 91 PID 4736 wrote to memory of 3932 4736 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 91 PID 4736 wrote to memory of 3932 4736 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 91 PID 3932 wrote to memory of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 3932 wrote to memory of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 3932 wrote to memory of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 3932 wrote to memory of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 3932 wrote to memory of 2920 3932 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 92 PID 2920 wrote to memory of 4832 2920 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 93 PID 2920 wrote to memory of 4832 2920 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 93 PID 2920 wrote to memory of 4832 2920 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 93 PID 4832 wrote to memory of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 4832 wrote to memory of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 4832 wrote to memory of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 4832 wrote to memory of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 4832 wrote to memory of 4336 4832 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 94 PID 4336 wrote to memory of 1780 4336 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 95 PID 4336 wrote to memory of 1780 4336 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 95 PID 4336 wrote to memory of 1780 4336 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 95 PID 1780 wrote to memory of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 1780 wrote to memory of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 1780 wrote to memory of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 1780 wrote to memory of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 1780 wrote to memory of 4388 1780 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 96 PID 4388 wrote to memory of 4712 4388 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 97 PID 4388 wrote to memory of 4712 4388 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 97 PID 4388 wrote to memory of 4712 4388 ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe4⤵
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath5⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe6⤵
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath7⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe8⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath9⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe10⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath11⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe12⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath13⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe14⤵
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath15⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe16⤵
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath17⤵
- Suspicious use of SetThreadContext
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe18⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath19⤵
- Suspicious use of SetThreadContext
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe20⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath21⤵
- Suspicious use of SetThreadContext
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe22⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath23⤵
- Suspicious use of SetThreadContext
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe24⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath25⤵
- Suspicious use of SetThreadContext
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe26⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath27⤵
- Suspicious use of SetThreadContext
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe28⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath29⤵
- Suspicious use of SetThreadContext
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe30⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath31⤵
- Suspicious use of SetThreadContext
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe32⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath33⤵
- Suspicious use of SetThreadContext
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe34⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath35⤵
- Suspicious use of SetThreadContext
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe36⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath37⤵
- Suspicious use of SetThreadContext
PID:428 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe38⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath39⤵
- Suspicious use of SetThreadContext
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe40⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath41⤵
- Suspicious use of SetThreadContext
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe42⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath43⤵
- Suspicious use of SetThreadContext
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe44⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath45⤵
- Suspicious use of SetThreadContext
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe46⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath47⤵
- Suspicious use of SetThreadContext
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe48⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath49⤵
- Suspicious use of SetThreadContext
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe50⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath51⤵
- Suspicious use of SetThreadContext
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe52⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath53⤵
- Suspicious use of SetThreadContext
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe54⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath55⤵
- Suspicious use of SetThreadContext
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe56⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath57⤵
- Suspicious use of SetThreadContext
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe58⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath59⤵
- Suspicious use of SetThreadContext
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe60⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath61⤵
- Suspicious use of SetThreadContext
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe62⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath63⤵
- Suspicious use of SetThreadContext
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe64⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath65⤵
- Suspicious use of SetThreadContext
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe66⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath67⤵
- Suspicious use of SetThreadContext
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe68⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath69⤵
- Suspicious use of SetThreadContext
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe70⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath71⤵
- Suspicious use of SetThreadContext
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe72⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath73⤵
- Suspicious use of SetThreadContext
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe74⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath75⤵
- Suspicious use of SetThreadContext
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe76⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath77⤵
- Suspicious use of SetThreadContext
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe78⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath79⤵
- Suspicious use of SetThreadContext
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe80⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath81⤵
- Suspicious use of SetThreadContext
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe82⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath83⤵
- Suspicious use of SetThreadContext
PID:704 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe84⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath85⤵
- Suspicious use of SetThreadContext
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe86⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath87⤵
- Suspicious use of SetThreadContext
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe88⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath89⤵
- Suspicious use of SetThreadContext
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe90⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath91⤵
- Suspicious use of SetThreadContext
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe92⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath93⤵
- Suspicious use of SetThreadContext
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe94⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath95⤵
- Suspicious use of SetThreadContext
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe96⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath97⤵
- Suspicious use of SetThreadContext
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe98⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath99⤵
- Suspicious use of SetThreadContext
PID:640 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe100⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath101⤵
- Suspicious use of SetThreadContext
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe102⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath103⤵
- Suspicious use of SetThreadContext
PID:816 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath105⤵
- Suspicious use of SetThreadContext
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe106⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath107⤵
- Suspicious use of SetThreadContext
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe108⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath109⤵
- Suspicious use of SetThreadContext
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe110⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath111⤵
- Suspicious use of SetThreadContext
PID:456 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe112⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath113⤵
- Suspicious use of SetThreadContext
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe114⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath115⤵
- Suspicious use of SetThreadContext
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe116⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath117⤵
- Suspicious use of SetThreadContext
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe118⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath119⤵
- Suspicious use of SetThreadContext
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe120⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeStubPath121⤵
- Suspicious use of SetThreadContext
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\ea2d40381b1c68070db71dadd170eff1_JaffaCakes118.exe122⤵
- System Location Discovery: System Language Discovery
PID:1444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-