Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
-
submitted
13/07/2024, 14:03
General
-
Target
41fc8d2013bb5f15968fcc4f8cb48f76_JaffaCakes118.exe
-
Size
17KB
-
MD5
41fc8d2013bb5f15968fcc4f8cb48f76
-
SHA1
3f29e244eb7122827e02a675fd56b356ec95cf08
-
SHA256
0e9996124fd897dfa6cbdd7844b993795856793be89e6af8f5a3bc382a16fba2
-
SHA512
b3fdb833a48c333006d8d45b489689eba84355161a5677ae68096fa7b85604937ffab97ec5683a97b19dc6c1c21cd96bb3399f4da9ca58c6339b19d9f84c54cf
-
SSDEEP
384:cKJPVHpv5qat4kD+59chtnN6qRleTtKfE51ELAKzn1M:bNYayu+sXnQaeTCEvoBn+
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in System32 directory 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\41fc8d2013bb5f15968fcc4f8cb48f76_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\41fc8d2013bb5f15968fcc4f8cb48f76_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe33⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe35⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe36⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe37⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe38⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe39⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe40⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe41⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe42⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe43⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe44⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe45⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe46⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe47⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe48⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe49⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe50⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe51⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe52⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe53⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe54⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe55⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe56⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe57⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe58⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe59⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe60⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe61⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe62⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe63⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe64⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe65⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe66⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe67⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe68⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe69⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe70⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe71⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe72⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe73⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe74⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe75⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe76⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe77⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe78⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe79⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe80⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe81⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe82⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe83⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe84⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe85⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe86⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe87⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe88⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe89⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe90⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe91⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe92⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe93⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe94⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe95⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe96⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe97⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe98⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe99⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe100⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe101⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe102⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe103⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe104⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe105⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe106⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe107⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe108⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe109⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe110⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe111⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe112⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe113⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe114⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe115⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe116⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe117⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe118⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe119⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe120⤵
-
C:\Windows\SysWOW64\dllcache\cache\daemon.exeC:\Windows\system32\dllcache\cache\daemon.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-