Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
03/07/2024, 19:14
Static task
static1
Behavioral task
behavioral1
Sample
2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe
-
Size
45KB
-
MD5
2373f9a4bd6afab0bb66a6eaa901b683
-
SHA1
04aa2f495e1ec539f53d699939637dc380614c64
-
SHA256
91965dc6502bf9537cc5ffbb07712eb5b1a4c7c65b740ed923e5b9bdd5764084
-
SHA512
905762a6953307525be2b5e1fd5cb596a40642f61b4fa1d24b802e438bbfb320833bf38fd33a2a44f76ee80ee26d12add01d63880875fba67c9c6ee57250fe1e
-
SSDEEP
768:ql5MArqCfY+XBaCWuwCuk8nqCnX04eU1w0444wY459dIkcYo+EJiBBBpt/zMV8wC:k/r/fY+XBhwCujnqCnX0g1w0444wY45F
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1880 cmd.exe -
Executes dropped EXE 64 IoCs
pid Process 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1580 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1960 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 692 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1632 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2280 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2260 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2368 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2956 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1600 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2236 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2052 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2392 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2728 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2748 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2624 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2764 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2680 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 316 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2520 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2596 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2968 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 3016 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 860 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1280 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1680 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2332 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 696 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe -
Loads dropped DLL 64 IoCs
pid Process 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found File created C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1580 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1960 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 692 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1632 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2280 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2260 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2368 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2956 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1600 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2236 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2052 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2392 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2728 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2748 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2624 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2764 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2680 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 316 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2520 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2596 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2968 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3016 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 860 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1280 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1680 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 2332 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 1780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 696 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2608 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2576 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2584 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2796 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1668 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2620 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1504 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1916 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1436 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1048 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2384 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2356 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1704 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1628 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 536 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1496 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1096 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 900 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1944 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 2488 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1688 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1380 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1676 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 1616 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2604 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 28 PID 2108 wrote to memory of 2604 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 28 PID 2108 wrote to memory of 2604 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 28 PID 2108 wrote to memory of 2604 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 28 PID 2108 wrote to memory of 1880 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 29 PID 2108 wrote to memory of 1880 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 29 PID 2108 wrote to memory of 1880 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 29 PID 2108 wrote to memory of 1880 2108 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 29 PID 2604 wrote to memory of 2104 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 30 PID 2604 wrote to memory of 2104 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 30 PID 2604 wrote to memory of 2104 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 30 PID 2604 wrote to memory of 2104 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 30 PID 2104 wrote to memory of 1244 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 31 PID 2104 wrote to memory of 1244 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 31 PID 2104 wrote to memory of 1244 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 31 PID 2104 wrote to memory of 1244 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 31 PID 2604 wrote to memory of 2624 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 32 PID 2604 wrote to memory of 2624 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 32 PID 2604 wrote to memory of 2624 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 32 PID 2604 wrote to memory of 2624 2604 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 32 PID 1244 wrote to memory of 2664 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 33 PID 1244 wrote to memory of 2664 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 33 PID 1244 wrote to memory of 2664 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 33 PID 1244 wrote to memory of 2664 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 33 PID 2664 wrote to memory of 2780 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 34 PID 2664 wrote to memory of 2780 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 34 PID 2664 wrote to memory of 2780 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 34 PID 2664 wrote to memory of 2780 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 34 PID 2104 wrote to memory of 2752 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 35 PID 2104 wrote to memory of 2752 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 35 PID 2104 wrote to memory of 2752 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 35 PID 2104 wrote to memory of 2752 2104 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 35 PID 1244 wrote to memory of 2676 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 36 PID 1244 wrote to memory of 2676 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 36 PID 1244 wrote to memory of 2676 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 36 PID 1244 wrote to memory of 2676 1244 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 36 PID 2664 wrote to memory of 2528 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 38 PID 2664 wrote to memory of 2528 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 38 PID 2664 wrote to memory of 2528 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 38 PID 2664 wrote to memory of 2528 2664 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 38 PID 2780 wrote to memory of 2724 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2724 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2724 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2724 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 37 PID 2780 wrote to memory of 2696 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 40 PID 2780 wrote to memory of 2696 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 40 PID 2780 wrote to memory of 2696 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 40 PID 2780 wrote to memory of 2696 2780 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 40 PID 2724 wrote to memory of 2784 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 39 PID 2724 wrote to memory of 2784 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 39 PID 2724 wrote to memory of 2784 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 39 PID 2724 wrote to memory of 2784 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 39 PID 2724 wrote to memory of 2656 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 42 PID 2724 wrote to memory of 2656 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 42 PID 2724 wrote to memory of 2656 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 42 PID 2724 wrote to memory of 2656 2724 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 42 PID 2784 wrote to memory of 2608 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2608 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2608 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2608 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 41 PID 2784 wrote to memory of 2524 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 44 PID 2784 wrote to memory of 2524 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 44 PID 2784 wrote to memory of 2524 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 44 PID 2784 wrote to memory of 2524 2784 2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2608 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2576 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2584 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2796 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1668 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2620 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1916 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1436 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1048 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2384 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2356 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:536 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1496 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1096 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:900 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1944 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2488 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1688 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1380 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1676 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1616 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:692 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2260 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2368 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2236 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2052 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2392 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2728 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2748 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2624 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2664 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2780 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2680 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2520 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2968 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3016 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:860 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe59⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1280 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1900 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1680 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1780 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:696 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe65⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe66⤵PID:912
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe67⤵PID:2988
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe68⤵PID:1864
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe69⤵PID:2920
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe70⤵PID:2904
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe71⤵PID:1788
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe72⤵PID:1136
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe73⤵PID:1628
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe74⤵PID:600
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe75⤵PID:1480
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe76⤵PID:1096
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe77⤵PID:708
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe78⤵PID:3068
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe79⤵PID:2492
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe80⤵PID:844
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe81⤵PID:1772
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe82⤵PID:2040
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe83⤵PID:932
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe84⤵PID:1956
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe85⤵PID:1960
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe86⤵PID:572
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe87⤵PID:1124
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe88⤵PID:980
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe89⤵PID:2960
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe90⤵PID:1576
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe91⤵PID:892
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe92⤵PID:2956
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe93⤵PID:2612
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe94⤵PID:2604
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe95⤵PID:2732
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe96⤵
- Drops file in System32 directory
PID:2788 -
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe97⤵PID:2808
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe98⤵PID:2676
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe99⤵PID:2256
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe100⤵PID:2832
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe101⤵PID:2632
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe102⤵PID:2536
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe103⤵PID:2784
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe104⤵PID:1324
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe105⤵PID:2972
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe106⤵PID:1264
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe107⤵PID:2584
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe108⤵PID:2716
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe109⤵PID:1448
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe110⤵PID:2164
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe111⤵PID:1848
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe112⤵PID:2160
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe113⤵PID:1828
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe114⤵PID:2864
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe115⤵PID:2984
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe116⤵PID:1436
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe117⤵PID:1592
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe118⤵PID:2500
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe119⤵PID:2356
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe120⤵PID:2924
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe121⤵PID:472
-
C:\Windows\SysWOW64\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exeC:\Windows\system32\2373f9a4bd6afab0bb66a6eaa901b683_JaffaCakes118.exe122⤵PID:2904
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-