xtremerat | 7291dfa90de1063b5cfe238606d5c61db8e886927065f9708282770380beac14

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/02/2025, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Size

260KB
MD5

95d47bf91b1118562ad6a7479b8ffdcf
SHA1

93c80224c963a5002c6556481253464fd282c820
SHA256

7291dfa90de1063b5cfe238606d5c61db8e886927065f9708282770380beac14
SHA512

c458227559463508ca1f73b675d2b1baf1a7bbb5b9b9f9a9596f5379665a361ced05d0ec8c86a0914aecd6b62d6e3aeb5cfa06814059529a4118bf728005024d
SSDEEP

1536:71KdM0mDw7jFd+/q0Z9LcQ91dWcbXIEx2sQKYkIpY8Gjvuh/cGsYDSKJPToHfPOe:lpY+/v971d5UKPj9udcr2SKJlD+w8

Score

10^/10

xtremerat discovery persistence rat spyware upx

Malware Config

Signatures

Detect XtremeRAT payload 4 IoCs

resource	yara_rule
behavioral1/memory/2564-6-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2564-5-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/2564-9-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat
behavioral1/memory/1932-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	family_xtremerat

XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
persistence spyware rat xtremerat
Xtremerat family
xtremerat

Suspicious use of SetThreadContext 32 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 1984 set thread context of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 2752 set thread context of 2636	2752	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	50
PID 2644 set thread context of 2704	2644	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	60
PID 1304 set thread context of 1776	1304	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	70
PID 288 set thread context of 1948	288	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	80
PID 1276 set thread context of 1748	1276	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	90
PID 2904 set thread context of 2740	2904	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	100
PID 1364 set thread context of 1924	1364	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	110
PID 780 set thread context of 1960	780	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	120
PID 2352 set thread context of 1544	2352	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	130
PID 1592 set thread context of 1224	1592	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	140
PID 2852 set thread context of 2728	2852	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	150
PID 1792 set thread context of 3052	1792	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	160
PID 568 set thread context of 2792	568	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	170
PID 300 set thread context of 584	300	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	180
PID 2388 set thread context of 2312	2388	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	190
PID 2464 set thread context of 2780	2464	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	200
PID 1736 set thread context of 928	1736	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	210
PID 2748 set thread context of 2860	2748	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	220
PID 2116 set thread context of 2360	2116	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	230
PID 3152 set thread context of 3168	3152	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	240
PID 3288 set thread context of 3304	3288	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	250
PID 3424 set thread context of 3440	3424	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	260
PID 3564 set thread context of 3580	3564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	270
PID 3700 set thread context of 3716	3700	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	280
PID 3844 set thread context of 3860	3844	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	290
PID 3984 set thread context of 4000	3984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	300
PID 916 set thread context of 3176	916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	310
PID 3408 set thread context of 3464	3408	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	320
PID 3740 set thread context of 3868	3740	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	330
PID 3160 set thread context of 3200	3160	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	340

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2564-6-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2564-5-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2564-4-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2564-2-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/2564-9-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/1932-15-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx
behavioral1/memory/1932-20-0x0000000000C80000-0x0000000000C95000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe

Suspicious use of SetWindowsHookEx 32 IoCs

pid	Process
2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2752	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2644	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1304	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
288	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1276	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2904	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1364	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
780	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2352	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1592	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2852	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1792	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
568	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
300	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2388	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2464	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
1736	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2748	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
2116	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3152	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3288	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3424	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3700	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3844	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3408	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3740	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
3160	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2916 wrote to memory of 2564	2916	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	28
PID 2564 wrote to memory of 2164	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	29
PID 2564 wrote to memory of 2164	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	29
PID 2564 wrote to memory of 2164	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	29
PID 2564 wrote to memory of 2164	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	29
PID 2564 wrote to memory of 2164	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	29
PID 2564 wrote to memory of 2304	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	30
PID 2564 wrote to memory of 2304	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	30
PID 2564 wrote to memory of 2304	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	30
PID 2564 wrote to memory of 2304	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	30
PID 2564 wrote to memory of 2304	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	30
PID 2564 wrote to memory of 1724	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	31
PID 2564 wrote to memory of 1724	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	31
PID 2564 wrote to memory of 1724	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	31
PID 2564 wrote to memory of 1724	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	31
PID 2564 wrote to memory of 1724	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	31
PID 2564 wrote to memory of 1300	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	32
PID 2564 wrote to memory of 1300	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	32
PID 2564 wrote to memory of 1300	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	32
PID 2564 wrote to memory of 1300	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	32
PID 2564 wrote to memory of 1300	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	32
PID 2564 wrote to memory of 2272	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	33
PID 2564 wrote to memory of 2272	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	33
PID 2564 wrote to memory of 2272	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	33
PID 2564 wrote to memory of 2272	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	33
PID 2564 wrote to memory of 2272	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	33
PID 2564 wrote to memory of 2284	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	34
PID 2564 wrote to memory of 2284	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	34
PID 2564 wrote to memory of 2284	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	34
PID 2564 wrote to memory of 2284	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	34
PID 2564 wrote to memory of 2284	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	34
PID 2564 wrote to memory of 2276	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	35
PID 2564 wrote to memory of 2276	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	35
PID 2564 wrote to memory of 2276	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	35
PID 2564 wrote to memory of 2276	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	35
PID 2564 wrote to memory of 2276	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	35
PID 2564 wrote to memory of 2180	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	36
PID 2564 wrote to memory of 2180	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	36
PID 2564 wrote to memory of 2180	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	36
PID 2564 wrote to memory of 2180	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	36
PID 2564 wrote to memory of 1984	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	37
PID 2564 wrote to memory of 1984	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	37
PID 2564 wrote to memory of 1984	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	37
PID 2564 wrote to memory of 1984	2564	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	37
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1984 wrote to memory of 1932	1984	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	38
PID 1932 wrote to memory of 2004	1932	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	39
PID 1932 wrote to memory of 2004	1932	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	39
PID 1932 wrote to memory of 2004	1932	JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe	39

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2164
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2304
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1724
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:1300
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2272
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2284
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2276
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    PID:2180
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
      "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2004
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1292
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2244
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2428
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2292
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2768
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:1248
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        5⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2752
      - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:1268
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2800
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:3016
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        7⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        7⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2508
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2556
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2600
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:3020
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:2956
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        9⤵
        
        PID:1764
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        9⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1568
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1536
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1704
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        11⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        11⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1596
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1088
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1448
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1396
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:264
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        13⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        13⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:1748
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:776
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2796
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        15⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        15⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2344
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:1532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2132
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2140
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:2516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        17⤵
        
        PID:108
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        17⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:1924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:2040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:684
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:1324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        19⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        19⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        20⤵
        System Location Discovery: System Language Discovery
        
        PID:1960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:692
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:2308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        21⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        21⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        22⤵
        System Location Discovery: System Language Discovery
        
        PID:1544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:864
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1944
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1876
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:3024
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1588
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        23⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        23⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:1224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:1256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2188
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2420
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2404
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2856
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        25⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        25⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2492
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2472
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2480
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:1604
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        27⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        27⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1676
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:2300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:1312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        29⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        29⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2816
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:904
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:3004
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:544
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:1716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        31⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        31⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:300
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:584
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2376
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:1504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:3028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2184
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2228
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        33⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        33⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2948
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2700
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:752
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2896
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:2296
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        35⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        35⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2828
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:3060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2968
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2924
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:936
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:2576
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1656
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        37⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        37⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:928
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2872
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2044
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2720
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:1940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:2128
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        39⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        39⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2844
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:3040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:2208
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:308
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        41⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        41⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:2360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:2512
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3100
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3112
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3120
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3132
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        43⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        43⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        44⤵
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3204
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3216
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3224
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3236
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3244
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3256
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3264
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        45⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        45⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3336
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3352
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3360
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3372
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3380
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3392
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3400
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        47⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        47⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3476
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3484
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3496
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3504
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3516
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3524
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3540
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        49⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        49⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        50⤵
        System Location Discovery: System Language Discovery
        
        PID:3580
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3620
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3628
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3640
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3648
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3660
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3668
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3680
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        51⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        51⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3760
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3768
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3784
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3792
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3804
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3812
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3824
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        53⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        53⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:3860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3900
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3912
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3920
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3932
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3940
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3952
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3960
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        55⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        55⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:4000
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4040
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4052
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4060
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4072
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4080
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:4092
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:2612
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        57⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        57⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        58⤵
        System Location Discovery: System Language Discovery
        
        PID:3176
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3284
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3300
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3320
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3272
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3388
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3324
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3436
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        59⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        59⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        60⤵
        System Location Discovery: System Language Discovery
        
        PID:3464
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3616
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3636
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:2444
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3696
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3724
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3732
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3756
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        61⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        61⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        62⤵
        System Location Discovery: System Language Discovery
        
        PID:3868
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:1860
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3884
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:3992
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:4008
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:4028
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:4036
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:4068
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        63⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        63⤵
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe
        
        "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_95d47bf91b1118562ad6a7479b8ffdcf.exe"
        64⤵
        System Location Discovery: System Language Discovery
        
        PID:3200
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3212
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3532
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3572
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3608
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3468
        
        C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe"
        65⤵
        
        PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\M5BTEa.cfg

Filesize
1KB

MD5
a5d1c62674c53c7c5e7b8b230cbbbe42

SHA1
95b8444b24890c4b0040e212d834c73f51b7ab52

SHA256
9efac950437965d03b52ac3064c017c8e555405d25c08db114eeed1b3bb1c2f1

SHA512
e981a3d7628cd351deeb0ded8323b8ec10e3837d8d44b3b6c5e405c98da2bd76d6342a889b210056d1cdfae53ae6e041a26ef2d4914cdd253a32ab643af072ab

Download Submit
memory/1932-15-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/1932-20-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2564-6-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2564-5-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2564-4-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2564-2-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download
memory/2564-9-0x0000000000C80000-0x0000000000C95000-memory.dmp

Filesize
84KB

Download