Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 20:31
General
-
Target
db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe
-
Size
78KB
-
MD5
db2a29365fa49dea85f6ffe5ef3dd98d
-
SHA1
3606c3d1e60eeb80b47eccb96933c52beabd9488
-
SHA256
d5bb40879e82d6c8b8587f122910a4ba7e96f1ac38f957f7edc1842e979b4f1a
-
SHA512
954fff0359bcf7131a4d65ceb43d605396a3cc4ec7ae99e8b9905659e24f502fb7ee60c2f511d695cbc3e14e5458511ea97d7eb13cabbcb92bad22ca4b754aa4
-
SSDEEP
1536:r1L5+h66Te0e0qPWrzVa2AIxBXBFsVNM1AQ4IIWoZcdGjJvuEc4J:ZLn6y0e49uIxB0OB+HJGE7
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\db2a29365fa49dea85f6ffe5ef3dd98d_JaffaCakes118.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe9⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe10⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe11⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe34⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe35⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe44⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe48⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe51⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe59⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe61⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe62⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe66⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe67⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe68⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe69⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe70⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe71⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe72⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe73⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe74⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe75⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe76⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe77⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe78⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe79⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe80⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe81⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe82⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe83⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe84⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe85⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe86⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe87⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe88⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe89⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe90⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe91⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe92⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe93⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe94⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe95⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe96⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe97⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe98⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe99⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe100⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe101⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe102⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe103⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe104⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe105⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe106⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe107⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe108⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe109⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe110⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe111⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe112⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe113⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe114⤵
- Checks computer location settings
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe115⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe116⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe117⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe118⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe119⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe120⤵
-
C:\Windows\SysWOW64\GroupPolicy\User\Scripts\Logon\wmi.exeC:\Windows\system32\GroupPolicy\User\Scripts\Logon\wmi.exe121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-