Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2024 23:16
Behavioral task
behavioral1
Sample
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe
-
Size
63KB
-
MD5
e38fe16fc51b3c42bef629ed62969f64
-
SHA1
cf295c7d03811b12dd897d3d9e711525c97e7897
-
SHA256
2aa84a58339db121008c76c2ce37839c11978f630ea862149d87339da0fb5e2f
-
SHA512
47f60e9081a501d06cabc01f5fc8d4c3cfef75ca21d5ddab3e578a5375dc3aa458dcba8c1fef35ad4c414938ed64b881793df3994e6933c16b9a27ccc5719b86
-
SSDEEP
1536:HJqEVsjMnWP8GfbqxlspHBhf07ZpJjOzov:VVUsWUHlmuZpks
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 64 IoCs
resource yara_rule behavioral2/files/0x0007000000023504-14.dat modiloader_stage2 behavioral2/files/0x0007000000023503-20.dat modiloader_stage2 behavioral2/memory/2376-21-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3472-39-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4404-57-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3816-74-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1420-91-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3560-107-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2596-124-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/836-141-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2664-159-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/5032-175-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/5088-192-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4808-210-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/444-226-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3876-243-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1916-261-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4292-277-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1048-291-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4760-304-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3444-317-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4364-330-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4496-343-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2456-356-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/5068-369-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4852-382-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/684-395-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2480-408-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3808-421-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3440-434-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4884-447-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1816-460-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3424-473-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3416-486-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3928-499-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2892-512-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3760-525-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1800-538-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/916-551-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1628-564-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2124-577-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1856-590-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2388-603-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3420-616-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4396-629-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4364-642-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2456-655-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4400-668-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4968-681-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1984-694-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4268-707-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4548-720-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3680-733-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3248-746-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/536-759-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3272-772-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4504-785-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/2180-798-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/3376-811-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1932-824-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/4356-837-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1272-850-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/1796-863-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 behavioral2/memory/5072-876-0x0000000000400000-0x0000000000417000-memory.dmp modiloader_stage2 -
Executes dropped EXE 64 IoCs
pid Process 3472 rsoppmod.exe 4404 rsoppmod.exe 3816 rsoppmod.exe 1420 rsoppmod.exe 3560 rsoppmod.exe 2596 rsoppmod.exe 836 rsoppmod.exe 2664 rsoppmod.exe 5032 rsoppmod.exe 5088 rsoppmod.exe 4808 rsoppmod.exe 444 rsoppmod.exe 3876 rsoppmod.exe 1916 rsoppmod.exe 4292 rsoppmod.exe 1048 rsoppmod.exe 4760 rsoppmod.exe 3444 rsoppmod.exe 4364 rsoppmod.exe 4496 rsoppmod.exe 2456 rsoppmod.exe 5068 rsoppmod.exe 4852 rsoppmod.exe 684 rsoppmod.exe 2480 rsoppmod.exe 3808 rsoppmod.exe 3440 rsoppmod.exe 4884 rsoppmod.exe 1816 rsoppmod.exe 3424 rsoppmod.exe 3416 rsoppmod.exe 3928 rsoppmod.exe 2892 rsoppmod.exe 3760 rsoppmod.exe 1800 rsoppmod.exe 916 rsoppmod.exe 1628 rsoppmod.exe 2124 rsoppmod.exe 1856 rsoppmod.exe 2388 rsoppmod.exe 3420 rsoppmod.exe 4396 rsoppmod.exe 4364 rsoppmod.exe 2456 rsoppmod.exe 4400 rsoppmod.exe 4968 rsoppmod.exe 1984 rsoppmod.exe 4268 rsoppmod.exe 4548 rsoppmod.exe 3680 rsoppmod.exe 3248 rsoppmod.exe 536 rsoppmod.exe 3272 rsoppmod.exe 4504 rsoppmod.exe 2180 rsoppmod.exe 3376 rsoppmod.exe 1932 rsoppmod.exe 4356 rsoppmod.exe 1272 rsoppmod.exe 1796 rsoppmod.exe 5072 rsoppmod.exe 3012 rsoppmod.exe 4372 rsoppmod.exe 1100 rsoppmod.exe -
Loads dropped DLL 64 IoCs
pid Process 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 3472 rsoppmod.exe 3472 rsoppmod.exe 4404 rsoppmod.exe 4404 rsoppmod.exe 3816 rsoppmod.exe 3816 rsoppmod.exe 1420 rsoppmod.exe 1420 rsoppmod.exe 3560 rsoppmod.exe 3560 rsoppmod.exe 2596 rsoppmod.exe 2596 rsoppmod.exe 836 rsoppmod.exe 836 rsoppmod.exe 2664 rsoppmod.exe 2664 rsoppmod.exe 5032 rsoppmod.exe 5032 rsoppmod.exe 5088 rsoppmod.exe 5088 rsoppmod.exe 4808 rsoppmod.exe 4808 rsoppmod.exe 444 rsoppmod.exe 444 rsoppmod.exe 3876 rsoppmod.exe 3876 rsoppmod.exe 1916 rsoppmod.exe 1916 rsoppmod.exe 4292 rsoppmod.exe 4292 rsoppmod.exe 1048 rsoppmod.exe 1048 rsoppmod.exe 4760 rsoppmod.exe 4760 rsoppmod.exe 3444 rsoppmod.exe 3444 rsoppmod.exe 4364 rsoppmod.exe 4364 rsoppmod.exe 4496 rsoppmod.exe 4496 rsoppmod.exe 2456 rsoppmod.exe 2456 rsoppmod.exe 5068 rsoppmod.exe 5068 rsoppmod.exe 4852 rsoppmod.exe 4852 rsoppmod.exe 684 rsoppmod.exe 684 rsoppmod.exe 2480 rsoppmod.exe 2480 rsoppmod.exe 3808 rsoppmod.exe 3808 rsoppmod.exe 3440 rsoppmod.exe 3440 rsoppmod.exe 4884 rsoppmod.exe 4884 rsoppmod.exe 1816 rsoppmod.exe 1816 rsoppmod.exe 3424 rsoppmod.exe 3424 rsoppmod.exe 3416 rsoppmod.exe 3416 rsoppmod.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Modifies WinLogon 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" rsoppmod.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\Windows\\system32\\rsoppmod.exe" Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File created C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File created C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll rsoppmod.exe File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File created C:\Windows\SysWOW64\noisev.tmp rsoppmod.exe File opened for modification C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe rsoppmod.exe File created C:\Windows\SysWOW64\noisev.tmp Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found File opened for modification C:\Windows\SysWOW64\rsoppmod.exe Process not Found File created C:\Windows\SysWOW64\rsoppmod.exe Process not Found File opened for modification C:\Windows\SysWOW64\iasadv.dll Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rsoppmod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rsoppmod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rsoppmod.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 3472 rsoppmod.exe 3472 rsoppmod.exe 4404 rsoppmod.exe 4404 rsoppmod.exe 3816 rsoppmod.exe 3816 rsoppmod.exe 1420 rsoppmod.exe 1420 rsoppmod.exe 3560 rsoppmod.exe 3560 rsoppmod.exe 2596 rsoppmod.exe 2596 rsoppmod.exe 836 rsoppmod.exe 836 rsoppmod.exe 2664 rsoppmod.exe 2664 rsoppmod.exe 5032 rsoppmod.exe 5032 rsoppmod.exe 5088 rsoppmod.exe 5088 rsoppmod.exe 4808 rsoppmod.exe 4808 rsoppmod.exe 444 rsoppmod.exe 444 rsoppmod.exe 3876 rsoppmod.exe 3876 rsoppmod.exe 1916 rsoppmod.exe 1916 rsoppmod.exe 4292 rsoppmod.exe 4292 rsoppmod.exe 1048 rsoppmod.exe 1048 rsoppmod.exe 4760 rsoppmod.exe 4760 rsoppmod.exe 3444 rsoppmod.exe 3444 rsoppmod.exe 4364 rsoppmod.exe 4364 rsoppmod.exe 4496 rsoppmod.exe 4496 rsoppmod.exe 2456 rsoppmod.exe 2456 rsoppmod.exe 5068 rsoppmod.exe 5068 rsoppmod.exe 4852 rsoppmod.exe 4852 rsoppmod.exe 684 rsoppmod.exe 684 rsoppmod.exe 2480 rsoppmod.exe 2480 rsoppmod.exe 3808 rsoppmod.exe 3808 rsoppmod.exe 3440 rsoppmod.exe 3440 rsoppmod.exe 4884 rsoppmod.exe 4884 rsoppmod.exe 1816 rsoppmod.exe 1816 rsoppmod.exe 3424 rsoppmod.exe 3424 rsoppmod.exe 3416 rsoppmod.exe 3416 rsoppmod.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe Token: SeIncBasePriorityPrivilege 3472 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4404 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3816 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1420 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3560 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2596 rsoppmod.exe Token: SeIncBasePriorityPrivilege 836 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2664 rsoppmod.exe Token: SeIncBasePriorityPrivilege 5032 rsoppmod.exe Token: SeIncBasePriorityPrivilege 5088 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4808 rsoppmod.exe Token: SeIncBasePriorityPrivilege 444 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3876 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1916 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4292 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1048 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4760 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3444 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4364 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4496 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2456 rsoppmod.exe Token: SeIncBasePriorityPrivilege 5068 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4852 rsoppmod.exe Token: SeIncBasePriorityPrivilege 684 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2480 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3808 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3440 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4884 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1816 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3424 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3416 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3928 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2892 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3760 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1800 rsoppmod.exe Token: SeIncBasePriorityPrivilege 916 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1628 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2124 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1856 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2388 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3420 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4396 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4364 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2456 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4400 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4968 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1984 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4268 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4548 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3680 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3248 rsoppmod.exe Token: SeIncBasePriorityPrivilege 536 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3272 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4504 rsoppmod.exe Token: SeIncBasePriorityPrivilege 2180 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3376 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1932 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4356 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1272 rsoppmod.exe Token: SeIncBasePriorityPrivilege 1796 rsoppmod.exe Token: SeIncBasePriorityPrivilege 5072 rsoppmod.exe Token: SeIncBasePriorityPrivilege 3012 rsoppmod.exe Token: SeIncBasePriorityPrivilege 4372 rsoppmod.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 3472 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 82 PID 2376 wrote to memory of 3472 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 82 PID 2376 wrote to memory of 3472 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 82 PID 2376 wrote to memory of 2456 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 83 PID 2376 wrote to memory of 2456 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 83 PID 2376 wrote to memory of 2456 2376 e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe 83 PID 3472 wrote to memory of 4404 3472 rsoppmod.exe 84 PID 3472 wrote to memory of 4404 3472 rsoppmod.exe 84 PID 3472 wrote to memory of 4404 3472 rsoppmod.exe 84 PID 3472 wrote to memory of 1452 3472 rsoppmod.exe 85 PID 3472 wrote to memory of 1452 3472 rsoppmod.exe 85 PID 3472 wrote to memory of 1452 3472 rsoppmod.exe 85 PID 4404 wrote to memory of 3816 4404 rsoppmod.exe 86 PID 4404 wrote to memory of 3816 4404 rsoppmod.exe 86 PID 4404 wrote to memory of 3816 4404 rsoppmod.exe 86 PID 4404 wrote to memory of 3264 4404 rsoppmod.exe 87 PID 4404 wrote to memory of 3264 4404 rsoppmod.exe 87 PID 4404 wrote to memory of 3264 4404 rsoppmod.exe 87 PID 3816 wrote to memory of 1420 3816 rsoppmod.exe 88 PID 3816 wrote to memory of 1420 3816 rsoppmod.exe 88 PID 3816 wrote to memory of 1420 3816 rsoppmod.exe 88 PID 3816 wrote to memory of 3576 3816 rsoppmod.exe 89 PID 3816 wrote to memory of 3576 3816 rsoppmod.exe 89 PID 3816 wrote to memory of 3576 3816 rsoppmod.exe 89 PID 1420 wrote to memory of 3560 1420 rsoppmod.exe 90 PID 1420 wrote to memory of 3560 1420 rsoppmod.exe 90 PID 1420 wrote to memory of 3560 1420 rsoppmod.exe 90 PID 1420 wrote to memory of 1708 1420 rsoppmod.exe 91 PID 1420 wrote to memory of 1708 1420 rsoppmod.exe 91 PID 1420 wrote to memory of 1708 1420 rsoppmod.exe 91 PID 3560 wrote to memory of 2596 3560 rsoppmod.exe 92 PID 3560 wrote to memory of 2596 3560 rsoppmod.exe 92 PID 3560 wrote to memory of 2596 3560 rsoppmod.exe 92 PID 3560 wrote to memory of 932 3560 rsoppmod.exe 93 PID 3560 wrote to memory of 932 3560 rsoppmod.exe 93 PID 3560 wrote to memory of 932 3560 rsoppmod.exe 93 PID 2596 wrote to memory of 836 2596 rsoppmod.exe 94 PID 2596 wrote to memory of 836 2596 rsoppmod.exe 94 PID 2596 wrote to memory of 836 2596 rsoppmod.exe 94 PID 2596 wrote to memory of 888 2596 rsoppmod.exe 95 PID 2596 wrote to memory of 888 2596 rsoppmod.exe 95 PID 2596 wrote to memory of 888 2596 rsoppmod.exe 95 PID 836 wrote to memory of 2664 836 rsoppmod.exe 96 PID 836 wrote to memory of 2664 836 rsoppmod.exe 96 PID 836 wrote to memory of 2664 836 rsoppmod.exe 96 PID 836 wrote to memory of 2108 836 rsoppmod.exe 97 PID 836 wrote to memory of 2108 836 rsoppmod.exe 97 PID 836 wrote to memory of 2108 836 rsoppmod.exe 97 PID 2664 wrote to memory of 5032 2664 rsoppmod.exe 98 PID 2664 wrote to memory of 5032 2664 rsoppmod.exe 98 PID 2664 wrote to memory of 5032 2664 rsoppmod.exe 98 PID 2664 wrote to memory of 1720 2664 rsoppmod.exe 99 PID 2664 wrote to memory of 1720 2664 rsoppmod.exe 99 PID 2664 wrote to memory of 1720 2664 rsoppmod.exe 99 PID 5032 wrote to memory of 5088 5032 rsoppmod.exe 100 PID 5032 wrote to memory of 5088 5032 rsoppmod.exe 100 PID 5032 wrote to memory of 5088 5032 rsoppmod.exe 100 PID 5032 wrote to memory of 3656 5032 rsoppmod.exe 101 PID 5032 wrote to memory of 3656 5032 rsoppmod.exe 101 PID 5032 wrote to memory of 3656 5032 rsoppmod.exe 101 PID 5088 wrote to memory of 4808 5088 rsoppmod.exe 102 PID 5088 wrote to memory of 4808 5088 rsoppmod.exe 102 PID 5088 wrote to memory of 4808 5088 rsoppmod.exe 102 PID 5088 wrote to memory of 4856 5088 rsoppmod.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e38fe16fc51b3c42bef629ed62969f64_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:444 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3876 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1916 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1048 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4852 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:684 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3424 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2892 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3760 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:916 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2124 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1856 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2388 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3420 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4396 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4364 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2456 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4400 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4968 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1984 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4268 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4548 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3680 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3248 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:536 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3272 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4504 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2180 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3376 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1932 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4356 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1796 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5072 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3012 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4372 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe65⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe66⤵PID:2056
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe67⤵PID:3100
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe68⤵
- Modifies WinLogon
PID:3572 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe69⤵PID:3808
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe70⤵PID:3496
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe71⤵PID:2676
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe72⤵PID:2664
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe73⤵PID:3636
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe74⤵PID:1812
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe75⤵PID:4504
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe76⤵PID:1228
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe77⤵PID:640
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe78⤵PID:2184
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe79⤵PID:4088
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe80⤵PID:3948
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe81⤵PID:1284
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe82⤵PID:2864
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe83⤵PID:824
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe84⤵PID:5008
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe85⤵PID:3060
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe86⤵PID:2868
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe87⤵PID:1972
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe88⤵PID:4136
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe89⤵PID:4584
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe90⤵PID:3576
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe91⤵PID:836
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe92⤵PID:3608
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe93⤵PID:2888
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe94⤵PID:2504
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe95⤵PID:5076
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe96⤵
- Drops file in System32 directory
PID:508 -
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe97⤵PID:2748
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe98⤵PID:1448
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe99⤵PID:4292
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe100⤵PID:1852
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe101⤵PID:3084
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe102⤵PID:3380
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe103⤵PID:4964
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe104⤵PID:2324
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe105⤵PID:4976
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe106⤵PID:2092
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe107⤵PID:5016
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe108⤵PID:3528
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe109⤵PID:4268
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe110⤵PID:3980
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe111⤵PID:4884
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe112⤵PID:4024
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe113⤵PID:3416
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe114⤵PID:4488
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe115⤵PID:2932
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe116⤵PID:4856
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe117⤵PID:3964
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe118⤵PID:1924
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe119⤵PID:1688
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe120⤵PID:4960
-
C:\Windows\SysWOW64\rsoppmod.exeC:\Windows\system32\rsoppmod.exe121⤵PID:4760
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-