Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/02/2025, 16:13
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
-
Size
260KB
-
MD5
95d47bf91b1118562ad6a7479b8ffdcf
-
SHA1
93c80224c963a5002c6556481253464fd282c820
-
SHA256
7291dfa90de1063b5cfe238606d5c61db8e886927065f9708282770380beac14
-
SHA512
c458227559463508ca1f73b675d2b1baf1a7bbb5b9b9f9a9596f5379665a361ced05d0ec8c86a0914aecd6b62d6e3aeb5cfa06814059529a4118bf728005024d
-
SSDEEP
1536:71KdM0mDw7jFd+/q0Z9LcQ91dWcbXIEx2sQKYkIpY8Gjvuh/cGsYDSKJPToHfPOe:lpY+/v971d5UKPj9udcr2SKJlD+w8
Malware Config
Signatures
-
Detect XtremeRAT payload 4 IoCs
resource yara_rule behavioral1/memory/2564-6-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/2564-5-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/2564-9-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat behavioral1/memory/1932-20-0x0000000000C80000-0x0000000000C95000-memory.dmp family_xtremerat -
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Suspicious use of SetThreadContext 32 IoCs
description pid Process procid_target PID 2916 set thread context of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 1984 set thread context of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 2752 set thread context of 2636 2752 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 50 PID 2644 set thread context of 2704 2644 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 60 PID 1304 set thread context of 1776 1304 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 70 PID 288 set thread context of 1948 288 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 80 PID 1276 set thread context of 1748 1276 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 90 PID 2904 set thread context of 2740 2904 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 100 PID 1364 set thread context of 1924 1364 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 110 PID 780 set thread context of 1960 780 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 120 PID 2352 set thread context of 1544 2352 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 130 PID 1592 set thread context of 1224 1592 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 140 PID 2852 set thread context of 2728 2852 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 150 PID 1792 set thread context of 3052 1792 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 160 PID 568 set thread context of 2792 568 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 170 PID 300 set thread context of 584 300 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 180 PID 2388 set thread context of 2312 2388 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 190 PID 2464 set thread context of 2780 2464 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 200 PID 1736 set thread context of 928 1736 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 210 PID 2748 set thread context of 2860 2748 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 220 PID 2116 set thread context of 2360 2116 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 230 PID 3152 set thread context of 3168 3152 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 240 PID 3288 set thread context of 3304 3288 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 250 PID 3424 set thread context of 3440 3424 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 260 PID 3564 set thread context of 3580 3564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 270 PID 3700 set thread context of 3716 3700 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 280 PID 3844 set thread context of 3860 3844 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 290 PID 3984 set thread context of 4000 3984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 300 PID 916 set thread context of 3176 916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 310 PID 3408 set thread context of 3464 3408 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 320 PID 3740 set thread context of 3868 3740 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 330 PID 3160 set thread context of 3200 3160 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 340 -
resource yara_rule behavioral1/memory/2564-6-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/2564-5-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/2564-4-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/2564-2-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/2564-9-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1932-15-0x0000000000C80000-0x0000000000C95000-memory.dmp upx behavioral1/memory/1932-20-0x0000000000C80000-0x0000000000C95000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe -
Suspicious use of SetWindowsHookEx 32 IoCs
pid Process 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2752 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2644 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1304 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 288 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1276 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2904 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1364 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 780 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2352 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1592 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2852 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1792 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 568 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 300 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2388 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2464 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 1736 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2748 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 2116 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3152 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3288 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3424 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3700 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3844 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3408 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3740 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 3160 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2916 wrote to memory of 2564 2916 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 28 PID 2564 wrote to memory of 2164 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 29 PID 2564 wrote to memory of 2164 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 29 PID 2564 wrote to memory of 2164 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 29 PID 2564 wrote to memory of 2164 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 29 PID 2564 wrote to memory of 2164 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 29 PID 2564 wrote to memory of 2304 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 30 PID 2564 wrote to memory of 2304 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 30 PID 2564 wrote to memory of 2304 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 30 PID 2564 wrote to memory of 2304 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 30 PID 2564 wrote to memory of 2304 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 30 PID 2564 wrote to memory of 1724 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 31 PID 2564 wrote to memory of 1724 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 31 PID 2564 wrote to memory of 1724 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 31 PID 2564 wrote to memory of 1724 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 31 PID 2564 wrote to memory of 1724 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 31 PID 2564 wrote to memory of 1300 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 32 PID 2564 wrote to memory of 1300 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 32 PID 2564 wrote to memory of 1300 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 32 PID 2564 wrote to memory of 1300 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 32 PID 2564 wrote to memory of 1300 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 32 PID 2564 wrote to memory of 2272 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 33 PID 2564 wrote to memory of 2272 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 33 PID 2564 wrote to memory of 2272 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 33 PID 2564 wrote to memory of 2272 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 33 PID 2564 wrote to memory of 2272 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 33 PID 2564 wrote to memory of 2284 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 34 PID 2564 wrote to memory of 2284 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 34 PID 2564 wrote to memory of 2284 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 34 PID 2564 wrote to memory of 2284 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 34 PID 2564 wrote to memory of 2284 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 34 PID 2564 wrote to memory of 2276 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 35 PID 2564 wrote to memory of 2276 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 35 PID 2564 wrote to memory of 2276 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 35 PID 2564 wrote to memory of 2276 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 35 PID 2564 wrote to memory of 2276 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 35 PID 2564 wrote to memory of 2180 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 36 PID 2564 wrote to memory of 2180 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 36 PID 2564 wrote to memory of 2180 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 36 PID 2564 wrote to memory of 2180 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 36 PID 2564 wrote to memory of 1984 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 37 PID 2564 wrote to memory of 1984 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 37 PID 2564 wrote to memory of 1984 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 37 PID 2564 wrote to memory of 1984 2564 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 37 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1984 wrote to memory of 1932 1984 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 38 PID 1932 wrote to memory of 2004 1932 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 39 PID 1932 wrote to memory of 2004 1932 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 39 PID 1932 wrote to memory of 2004 1932 JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2164
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2304
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1724
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:1300
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2272
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2284
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2276
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"3⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2004
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1292
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2244
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2428
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2292
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:1248
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"5⤵PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"5⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"6⤵
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:1268
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2660
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2724
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2640
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2504
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2800
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:3016
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"7⤵PID:2580
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"7⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"8⤵
- System Location Discovery: System Language Discovery
PID:2704 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2508
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2556
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2600
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2944
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:3020
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2236
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:2956
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"9⤵PID:1764
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"9⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"10⤵
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1516
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1568
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1796
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1904
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1536
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1620
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1704
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"11⤵PID:1684
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"11⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:288 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"12⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1596
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1088
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1448
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1780
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:480
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1396
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:264
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"13⤵PID:1332
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"13⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"14⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:784
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:776
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2696
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2804
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2692
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2796
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"15⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"15⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"16⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:1492
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:2344
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:444
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:1532
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:2132
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:2140
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:2516
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"17⤵PID:108
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"17⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"18⤵
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:2992
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:1320
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:1868
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:2812
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:2040
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:684
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:1324
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"19⤵PID:892
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"19⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:780 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"20⤵
- System Location Discovery: System Language Discovery
PID:1960 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:692
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:2656
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:2324
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:2320
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:2308
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:1732
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:572
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"21⤵PID:1720
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"21⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"22⤵
- System Location Discovery: System Language Discovery
PID:1544 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:864
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:1944
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:1876
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:1896
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:3024
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:1588
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"23⤵PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"23⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"24⤵
- System Location Discovery: System Language Discovery
PID:1224 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:1256
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2188
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2400
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2420
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2256
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2404
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2856
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"25⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"25⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"26⤵
- System Location Discovery: System Language Discovery
PID:2728 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2476
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2492
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2544
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2472
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2480
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:1512
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:1604
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"27⤵PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"27⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"28⤵
- System Location Discovery: System Language Discovery
PID:3052 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:1676
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:392
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:2300
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:1784
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:1844
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:1680
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:1312
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"29⤵PID:924
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"29⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:568 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"30⤵
- System Location Discovery: System Language Discovery
PID:2792 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:2816
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:904
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:3004
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:940
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:1092
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:544
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:1716
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"31⤵PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"31⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:300 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"32⤵
- System Location Discovery: System Language Discovery
PID:584 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:1768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:2376
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:532
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:1504
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:3028
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:2184
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:2228
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"33⤵PID:2840
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"33⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"34⤵
- System Location Discovery: System Language Discovery
PID:2312 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:2380
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:2948
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:2700
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:752
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:2896
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:2296
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:1576
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"35⤵PID:1548
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"35⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"36⤵
- System Location Discovery: System Language Discovery
PID:2780 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:2828
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:3060
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:2968
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:2924
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:2576
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:1656
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"37⤵PID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"37⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"38⤵
- System Location Discovery: System Language Discovery
PID:928 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2872
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2044
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2720
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2524
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:1940
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2732
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:2128
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"39⤵PID:972
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"39⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"40⤵
- System Location Discovery: System Language Discovery
PID:2860 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:1484
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:2844
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:2436
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:1028
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:3040
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:2208
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:308
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"41⤵PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"41⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"42⤵
- System Location Discovery: System Language Discovery
PID:2360 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:2512
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3080
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3092
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3100
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3112
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3120
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3132
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"43⤵PID:3140
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"43⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"44⤵
- System Location Discovery: System Language Discovery
PID:3168 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3204
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3216
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3224
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3236
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3244
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3256
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3264
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"45⤵PID:3276
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"45⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"46⤵
- System Location Discovery: System Language Discovery
PID:3304 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3336
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3352
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3360
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3372
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3380
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3392
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3400
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"47⤵PID:3412
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"47⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"48⤵
- System Location Discovery: System Language Discovery
PID:3440 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3476
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3484
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3496
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3504
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3516
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3524
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3540
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"49⤵PID:3548
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"49⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"50⤵
- System Location Discovery: System Language Discovery
PID:3580 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3620
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3628
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3640
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3648
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3660
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3668
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3680
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"51⤵PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"51⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"52⤵
- System Location Discovery: System Language Discovery
PID:3716 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3760
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3768
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3784
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3792
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3804
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3812
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3824
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"53⤵PID:3832
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"53⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"54⤵
- System Location Discovery: System Language Discovery
PID:3860 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3900
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3912
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3920
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3932
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3940
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3952
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3960
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"55⤵PID:3972
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"55⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"56⤵
- System Location Discovery: System Language Discovery
PID:4000 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4040
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4052
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4060
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4072
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4080
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:4092
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:2612
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"57⤵PID:3108
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"57⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:916 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"58⤵
- System Location Discovery: System Language Discovery
PID:3176 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3284
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3300
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3320
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3272
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3388
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3324
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3436
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"59⤵PID:3452
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"59⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"60⤵
- System Location Discovery: System Language Discovery
PID:3464 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3616
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3636
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:2444
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3696
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3724
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3732
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3756
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"61⤵PID:3780
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"61⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"62⤵
- System Location Discovery: System Language Discovery
PID:3868 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:1860
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:3884
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:3992
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:4008
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:4028
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:4036
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:4068
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"63⤵PID:4024
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"63⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"64⤵
- System Location Discovery: System Language Discovery
PID:3200 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3212
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3532
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3572
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3608
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3468
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"65⤵PID:3748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5d1c62674c53c7c5e7b8b230cbbbe42
SHA195b8444b24890c4b0040e212d834c73f51b7ab52
SHA2569efac950437965d03b52ac3064c017c8e555405d25c08db114eeed1b3bb1c2f1
SHA512e981a3d7628cd351deeb0ded8323b8ec10e3837d8d44b3b6c5e405c98da2bd76d6342a889b210056d1cdfae53ae6e041a26ef2d4914cdd253a32ab643af072ab