Analysis
-
max time kernel
34s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20-09-2024 19:56
Behavioral task
behavioral1
Sample
ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe
-
Size
301KB
-
MD5
ee51a087d5dc2b078fe32651202d964e
-
SHA1
a1c81574a0eb4f3a066fcf593fee215733524a31
-
SHA256
28c0647e6589a27872eea7158b066d291b40767daef5642e8fe4b9a0479de3b3
-
SHA512
17448623c8f598d775b8848881459ab035f425ec134d5e25ed6ddd0c4ed1efd5f8aee4d741845cb4acf6d4578ff16825266dd83543591f4946788243058e11b6
-
SSDEEP
6144:hDKOloJ7dZGPGVNN6dEf0/wogNUHlyDUIzuCEUPE:h7loBFV2IS7gNTNuN
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
ModiLoader Second Stage 1 IoCs
resource yara_rule behavioral2/memory/1780-6-0x0000000000400000-0x0000000000453000-memory.dmp modiloader_stage2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe -
Executes dropped EXE 64 IoCs
pid Process 3972 asd.scr 2328 asd.scr 4468 asd.scr 552 asd.scr 548 asd.scr 924 asd.scr 5008 asd.scr 3144 asd.scr 4884 asd.scr 2992 asd.scr 1476 asd.scr 3476 asd.scr 4568 asd.scr 3976 asd.scr 1664 asd.scr 224 asd.scr 2256 asd.scr 3284 asd.scr 2564 asd.scr 2828 asd.scr 3240 asd.scr 404 asd.scr 3984 asd.scr 1496 asd.scr 4564 asd.scr 872 asd.scr 2900 asd.scr 1932 asd.scr 4264 asd.scr 944 asd.scr 2220 asd.scr 2912 asd.scr 3440 asd.scr 1248 asd.scr 4216 asd.scr 1608 asd.scr 2452 asd.scr 2932 asd.scr 2632 asd.scr 3096 asd.scr 4776 asd.scr 5008 asd.scr 3144 asd.scr 4324 asd.scr 4608 asd.scr 1564 asd.scr 1864 asd.scr 316 asd.scr 3976 asd.scr 3908 asd.scr 3624 asd.scr 2020 asd.scr 3524 asd.scr 3372 asd.scr 2132 asd.scr 2676 asd.scr 2536 asd.scr 3960 asd.scr 3716 asd.scr 1436 asd.scr 4832 asd.scr 3596 asd.scr 1572 asd.scr 4520 asd.scr -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini asd.scr File opened for modification C:\Windows\assembly\Desktop.ini asd.scr -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly asd.scr File created C:\Windows\assembly\Desktop.ini asd.scr File opened for modification C:\Windows\assembly\Desktop.ini asd.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 3972 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 2328 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 4468 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 552 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 548 asd.scr 4468 asd.scr 4468 asd.scr 2328 asd.scr 2328 asd.scr 3972 asd.scr 3972 asd.scr 552 asd.scr 552 asd.scr 924 asd.scr -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3972 asd.scr Token: SeDebugPrivilege 2328 asd.scr Token: SeDebugPrivilege 4468 asd.scr Token: SeDebugPrivilege 552 asd.scr Token: SeDebugPrivilege 548 asd.scr Token: SeDebugPrivilege 924 asd.scr Token: SeDebugPrivilege 5008 asd.scr Token: SeDebugPrivilege 3144 asd.scr Token: SeDebugPrivilege 4884 asd.scr Token: SeDebugPrivilege 2992 asd.scr Token: SeDebugPrivilege 1476 asd.scr Token: SeDebugPrivilege 3476 asd.scr Token: SeDebugPrivilege 4568 asd.scr Token: SeDebugPrivilege 3976 asd.scr Token: SeDebugPrivilege 1664 asd.scr Token: SeDebugPrivilege 224 asd.scr Token: SeDebugPrivilege 2256 asd.scr Token: SeDebugPrivilege 3284 asd.scr Token: SeDebugPrivilege 2564 asd.scr Token: SeDebugPrivilege 2828 asd.scr Token: SeDebugPrivilege 3240 asd.scr Token: SeDebugPrivilege 404 asd.scr Token: SeDebugPrivilege 3984 asd.scr Token: SeDebugPrivilege 1496 asd.scr Token: SeDebugPrivilege 4564 asd.scr Token: SeDebugPrivilege 872 asd.scr Token: SeDebugPrivilege 2900 asd.scr Token: SeDebugPrivilege 1932 asd.scr Token: SeDebugPrivilege 4264 asd.scr Token: SeDebugPrivilege 944 asd.scr Token: SeDebugPrivilege 2220 asd.scr Token: SeDebugPrivilege 2912 asd.scr Token: SeDebugPrivilege 3440 asd.scr Token: SeDebugPrivilege 1248 asd.scr Token: SeDebugPrivilege 4216 asd.scr Token: SeDebugPrivilege 1608 asd.scr Token: SeDebugPrivilege 2452 asd.scr Token: SeDebugPrivilege 2932 asd.scr Token: SeDebugPrivilege 2632 asd.scr Token: SeDebugPrivilege 3096 asd.scr Token: SeDebugPrivilege 4776 asd.scr Token: SeDebugPrivilege 5008 asd.scr Token: SeDebugPrivilege 3144 asd.scr Token: SeDebugPrivilege 4324 asd.scr Token: SeDebugPrivilege 4608 asd.scr Token: SeDebugPrivilege 1564 asd.scr Token: SeDebugPrivilege 1864 asd.scr Token: SeDebugPrivilege 316 asd.scr Token: SeDebugPrivilege 3976 asd.scr Token: SeDebugPrivilege 3908 asd.scr Token: SeDebugPrivilege 3624 asd.scr Token: SeDebugPrivilege 2020 asd.scr Token: SeDebugPrivilege 3524 asd.scr Token: SeDebugPrivilege 3372 asd.scr Token: SeDebugPrivilege 2132 asd.scr Token: SeDebugPrivilege 2676 asd.scr Token: SeDebugPrivilege 2536 asd.scr Token: SeDebugPrivilege 3960 asd.scr Token: SeDebugPrivilege 3716 asd.scr Token: SeDebugPrivilege 1436 asd.scr Token: SeDebugPrivilege 4832 asd.scr Token: SeDebugPrivilege 3596 asd.scr Token: SeDebugPrivilege 1572 asd.scr Token: SeDebugPrivilege 4520 asd.scr -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 3972 1780 ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe 82 PID 1780 wrote to memory of 3972 1780 ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe 82 PID 3972 wrote to memory of 2328 3972 asd.scr 83 PID 3972 wrote to memory of 2328 3972 asd.scr 83 PID 2328 wrote to memory of 4468 2328 asd.scr 84 PID 2328 wrote to memory of 4468 2328 asd.scr 84 PID 4468 wrote to memory of 552 4468 asd.scr 85 PID 4468 wrote to memory of 552 4468 asd.scr 85 PID 552 wrote to memory of 548 552 asd.scr 87 PID 552 wrote to memory of 548 552 asd.scr 87 PID 548 wrote to memory of 924 548 asd.scr 88 PID 548 wrote to memory of 924 548 asd.scr 88 PID 924 wrote to memory of 5008 924 asd.scr 124 PID 924 wrote to memory of 5008 924 asd.scr 124 PID 5008 wrote to memory of 3144 5008 asd.scr 125 PID 5008 wrote to memory of 3144 5008 asd.scr 125 PID 3144 wrote to memory of 4884 3144 asd.scr 91 PID 3144 wrote to memory of 4884 3144 asd.scr 91 PID 4884 wrote to memory of 2992 4884 asd.scr 92 PID 4884 wrote to memory of 2992 4884 asd.scr 92 PID 2992 wrote to memory of 1476 2992 asd.scr 93 PID 2992 wrote to memory of 1476 2992 asd.scr 93 PID 1476 wrote to memory of 3476 1476 asd.scr 94 PID 1476 wrote to memory of 3476 1476 asd.scr 94 PID 3476 wrote to memory of 4568 3476 asd.scr 95 PID 3476 wrote to memory of 4568 3476 asd.scr 95 PID 4568 wrote to memory of 3976 4568 asd.scr 131 PID 4568 wrote to memory of 3976 4568 asd.scr 131 PID 3976 wrote to memory of 1664 3976 asd.scr 97 PID 3976 wrote to memory of 1664 3976 asd.scr 97 PID 1664 wrote to memory of 224 1664 asd.scr 98 PID 1664 wrote to memory of 224 1664 asd.scr 98 PID 224 wrote to memory of 2256 224 asd.scr 99 PID 224 wrote to memory of 2256 224 asd.scr 99 PID 2256 wrote to memory of 3284 2256 asd.scr 100 PID 2256 wrote to memory of 3284 2256 asd.scr 100 PID 3284 wrote to memory of 2564 3284 asd.scr 101 PID 3284 wrote to memory of 2564 3284 asd.scr 101 PID 2564 wrote to memory of 2828 2564 asd.scr 102 PID 2564 wrote to memory of 2828 2564 asd.scr 102 PID 2828 wrote to memory of 3240 2828 asd.scr 103 PID 2828 wrote to memory of 3240 2828 asd.scr 103 PID 3240 wrote to memory of 404 3240 asd.scr 104 PID 3240 wrote to memory of 404 3240 asd.scr 104 PID 404 wrote to memory of 3984 404 asd.scr 105 PID 404 wrote to memory of 3984 404 asd.scr 105 PID 3984 wrote to memory of 1496 3984 asd.scr 106 PID 3984 wrote to memory of 1496 3984 asd.scr 106 PID 1496 wrote to memory of 4564 1496 asd.scr 107 PID 1496 wrote to memory of 4564 1496 asd.scr 107 PID 4564 wrote to memory of 872 4564 asd.scr 108 PID 4564 wrote to memory of 872 4564 asd.scr 108 PID 872 wrote to memory of 2900 872 asd.scr 109 PID 872 wrote to memory of 2900 872 asd.scr 109 PID 2900 wrote to memory of 1932 2900 asd.scr 110 PID 2900 wrote to memory of 1932 2900 asd.scr 110 PID 1932 wrote to memory of 4264 1932 asd.scr 111 PID 1932 wrote to memory of 4264 1932 asd.scr 111 PID 4264 wrote to memory of 944 4264 asd.scr 112 PID 4264 wrote to memory of 944 4264 asd.scr 112 PID 944 wrote to memory of 2220 944 asd.scr 113 PID 944 wrote to memory of 2220 944 asd.scr 113 PID 2220 wrote to memory of 2912 2220 asd.scr 114 PID 2220 wrote to memory of 2912 2220 asd.scr 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ee51a087d5dc2b078fe32651202d964e_JaffaCakes118.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\asd.scr"C:\Users\Admin\AppData\Local\Temp\asd.scr" /S2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr9⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr10⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr14⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr15⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr16⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr17⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr18⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr19⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr20⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr21⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr22⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr23⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr24⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr25⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr26⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr27⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr28⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr29⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr30⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr31⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr32⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr33⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr34⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr35⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr36⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr37⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr38⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr39⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr40⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr41⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr42⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr43⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr44⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr45⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr46⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr47⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr48⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr49⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:316 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr50⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr51⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr52⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr53⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr54⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr55⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr56⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr57⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr58⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr59⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr60⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr61⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr62⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr63⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr64⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr65⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr66⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr67⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr68⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr69⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr70⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr71⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr72⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr73⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr74⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr75⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr76⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr77⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr78⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr79⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr80⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr81⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr82⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr83⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr84⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr85⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr86⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr87⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr88⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr89⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr90⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr91⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr92⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr93⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr94⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr95⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr96⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr97⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr98⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr99⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr100⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr101⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr102⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr103⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr104⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr105⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr106⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr107⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr108⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr109⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr111⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr112⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr113⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr114⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr115⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr116⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr117⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr118⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr119⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr120⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr121⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\asd.scrC:\Users\Admin\AppData\Local\Temp\asd.scr122⤵PID:3920
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-