Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 15:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
Resource
win7-20240704-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe
-
Size
186KB
-
MD5
faa68f4cac61953b31bd4fdf8e11f765
-
SHA1
62aa856e75853bd4c7b96fe20d2dc34b448944da
-
SHA256
b394810f960459d683316463f67f7c95a2b2cdc736573b0b021f630f1b5754e3
-
SHA512
663474d3724ad9e96038900044f4c9f096f482542d727e60b9e7a48f481c07e21e544926ae20c71e58d00967a064565e940c409c0775847593c60cc32f8cbb4d
-
SSDEEP
3072:4LbKuZKzXw2RjwkfqrIWUEbskfsmbL9Nn0uNFi+O0xShCzukYr+:ehKDHpwspcb4mn9Nr5OCgCzuBK
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3044 wuauolts.exe 1896 wuauolts.exe 1336 wuauolts.exe 1728 wuauolts.exe 1580 wuauolts.exe 2772 wuauolts.exe 2768 wuauolts.exe 2576 wuauolts.exe 2860 wuauolts.exe 2864 wuauolts.exe 1604 wuauolts.exe 2264 wuauolts.exe 2836 wuauolts.exe 1956 wuauolts.exe 1780 wuauolts.exe 2816 wuauolts.exe 2804 wuauolts.exe 2900 wuauolts.exe 2628 wuauolts.exe 1228 wuauolts.exe 1300 wuauolts.exe 2172 wuauolts.exe 2124 wuauolts.exe 2060 wuauolts.exe 2088 wuauolts.exe 1368 wuauolts.exe 912 wuauolts.exe 1152 wuauolts.exe 2080 wuauolts.exe 1724 wuauolts.exe 928 wuauolts.exe 2216 wuauolts.exe 1584 wuauolts.exe 900 wuauolts.exe 2248 wuauolts.exe 1440 wuauolts.exe 1016 wuauolts.exe 2996 wuauolts.exe 560 wuauolts.exe 2240 wuauolts.exe 2232 wuauolts.exe 344 wuauolts.exe 1856 wuauolts.exe 2212 wuauolts.exe 1464 wuauolts.exe 2292 wuauolts.exe 1764 wuauolts.exe 2056 wuauolts.exe 2712 wuauolts.exe 2788 wuauolts.exe 2684 wuauolts.exe 2652 wuauolts.exe 536 wuauolts.exe 2424 wuauolts.exe 2924 wuauolts.exe 1960 wuauolts.exe 2916 wuauolts.exe 2932 wuauolts.exe 948 wuauolts.exe 1776 wuauolts.exe 2396 wuauolts.exe 2464 wuauolts.exe 880 wuauolts.exe 1512 wuauolts.exe -
Loads dropped DLL 64 IoCs
pid Process 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 3044 wuauolts.exe 3044 wuauolts.exe 1896 wuauolts.exe 1896 wuauolts.exe 1336 wuauolts.exe 1336 wuauolts.exe 1728 wuauolts.exe 1728 wuauolts.exe 1580 wuauolts.exe 1580 wuauolts.exe 2772 wuauolts.exe 2772 wuauolts.exe 2768 wuauolts.exe 2768 wuauolts.exe 2576 wuauolts.exe 2576 wuauolts.exe 2860 wuauolts.exe 2860 wuauolts.exe 2864 wuauolts.exe 2864 wuauolts.exe 1604 wuauolts.exe 1604 wuauolts.exe 2264 wuauolts.exe 2264 wuauolts.exe 2836 wuauolts.exe 2836 wuauolts.exe 1956 wuauolts.exe 1956 wuauolts.exe 1780 wuauolts.exe 1780 wuauolts.exe 2816 wuauolts.exe 2816 wuauolts.exe 2804 wuauolts.exe 2804 wuauolts.exe 2900 wuauolts.exe 2900 wuauolts.exe 2628 wuauolts.exe 2628 wuauolts.exe 1228 wuauolts.exe 1228 wuauolts.exe 1300 wuauolts.exe 1300 wuauolts.exe 2172 wuauolts.exe 2172 wuauolts.exe 2124 wuauolts.exe 2124 wuauolts.exe 2060 wuauolts.exe 2060 wuauolts.exe 2088 wuauolts.exe 2088 wuauolts.exe 1368 wuauolts.exe 1368 wuauolts.exe 912 wuauolts.exe 912 wuauolts.exe 1152 wuauolts.exe 1152 wuauolts.exe 2080 wuauolts.exe 2080 wuauolts.exe 1724 wuauolts.exe 1724 wuauolts.exe 928 wuauolts.exe 928 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\p: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\u: Process not Found File opened (read-only) \??\t: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\l: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\t: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\k: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\w: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\e: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\o: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\u: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\k: Process not Found File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\y: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\v: Process not Found File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\u: Process not Found File opened (read-only) \??\s: Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 3044 wuauolts.exe 1896 wuauolts.exe 1336 wuauolts.exe 1728 wuauolts.exe 1580 wuauolts.exe 2772 wuauolts.exe 2768 wuauolts.exe 2576 wuauolts.exe 2860 wuauolts.exe 2864 wuauolts.exe 1604 wuauolts.exe 2264 wuauolts.exe 2836 wuauolts.exe 1956 wuauolts.exe 1780 wuauolts.exe 2816 wuauolts.exe 2804 wuauolts.exe 2900 wuauolts.exe 2628 wuauolts.exe 1228 wuauolts.exe 1300 wuauolts.exe 2172 wuauolts.exe 2124 wuauolts.exe 2060 wuauolts.exe 2088 wuauolts.exe 1368 wuauolts.exe 912 wuauolts.exe 1152 wuauolts.exe 2080 wuauolts.exe 1724 wuauolts.exe 928 wuauolts.exe 2216 wuauolts.exe 1584 wuauolts.exe 900 wuauolts.exe 2248 wuauolts.exe 1440 wuauolts.exe 1016 wuauolts.exe 2996 wuauolts.exe 560 wuauolts.exe 2240 wuauolts.exe 2232 wuauolts.exe 344 wuauolts.exe 1856 wuauolts.exe 2212 wuauolts.exe 1464 wuauolts.exe 2292 wuauolts.exe 1764 wuauolts.exe 2056 wuauolts.exe 2712 wuauolts.exe 2788 wuauolts.exe 2684 wuauolts.exe 2652 wuauolts.exe 536 wuauolts.exe 2424 wuauolts.exe 2924 wuauolts.exe 1960 wuauolts.exe 2916 wuauolts.exe 2932 wuauolts.exe 948 wuauolts.exe 1776 wuauolts.exe 2396 wuauolts.exe 2464 wuauolts.exe 880 wuauolts.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3044 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 31 PID 3032 wrote to memory of 3044 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 31 PID 3032 wrote to memory of 3044 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 31 PID 3032 wrote to memory of 3044 3032 faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe 31 PID 3044 wrote to memory of 1896 3044 wuauolts.exe 32 PID 3044 wrote to memory of 1896 3044 wuauolts.exe 32 PID 3044 wrote to memory of 1896 3044 wuauolts.exe 32 PID 3044 wrote to memory of 1896 3044 wuauolts.exe 32 PID 1896 wrote to memory of 1336 1896 wuauolts.exe 33 PID 1896 wrote to memory of 1336 1896 wuauolts.exe 33 PID 1896 wrote to memory of 1336 1896 wuauolts.exe 33 PID 1896 wrote to memory of 1336 1896 wuauolts.exe 33 PID 1336 wrote to memory of 1728 1336 wuauolts.exe 34 PID 1336 wrote to memory of 1728 1336 wuauolts.exe 34 PID 1336 wrote to memory of 1728 1336 wuauolts.exe 34 PID 1336 wrote to memory of 1728 1336 wuauolts.exe 34 PID 1728 wrote to memory of 1580 1728 wuauolts.exe 35 PID 1728 wrote to memory of 1580 1728 wuauolts.exe 35 PID 1728 wrote to memory of 1580 1728 wuauolts.exe 35 PID 1728 wrote to memory of 1580 1728 wuauolts.exe 35 PID 1580 wrote to memory of 2772 1580 wuauolts.exe 36 PID 1580 wrote to memory of 2772 1580 wuauolts.exe 36 PID 1580 wrote to memory of 2772 1580 wuauolts.exe 36 PID 1580 wrote to memory of 2772 1580 wuauolts.exe 36 PID 2772 wrote to memory of 2768 2772 wuauolts.exe 37 PID 2772 wrote to memory of 2768 2772 wuauolts.exe 37 PID 2772 wrote to memory of 2768 2772 wuauolts.exe 37 PID 2772 wrote to memory of 2768 2772 wuauolts.exe 37 PID 2768 wrote to memory of 2576 2768 wuauolts.exe 38 PID 2768 wrote to memory of 2576 2768 wuauolts.exe 38 PID 2768 wrote to memory of 2576 2768 wuauolts.exe 38 PID 2768 wrote to memory of 2576 2768 wuauolts.exe 38 PID 2576 wrote to memory of 2860 2576 wuauolts.exe 39 PID 2576 wrote to memory of 2860 2576 wuauolts.exe 39 PID 2576 wrote to memory of 2860 2576 wuauolts.exe 39 PID 2576 wrote to memory of 2860 2576 wuauolts.exe 39 PID 2860 wrote to memory of 2864 2860 wuauolts.exe 40 PID 2860 wrote to memory of 2864 2860 wuauolts.exe 40 PID 2860 wrote to memory of 2864 2860 wuauolts.exe 40 PID 2860 wrote to memory of 2864 2860 wuauolts.exe 40 PID 2864 wrote to memory of 1604 2864 wuauolts.exe 41 PID 2864 wrote to memory of 1604 2864 wuauolts.exe 41 PID 2864 wrote to memory of 1604 2864 wuauolts.exe 41 PID 2864 wrote to memory of 1604 2864 wuauolts.exe 41 PID 1604 wrote to memory of 2264 1604 wuauolts.exe 42 PID 1604 wrote to memory of 2264 1604 wuauolts.exe 42 PID 1604 wrote to memory of 2264 1604 wuauolts.exe 42 PID 1604 wrote to memory of 2264 1604 wuauolts.exe 42 PID 2264 wrote to memory of 2836 2264 wuauolts.exe 43 PID 2264 wrote to memory of 2836 2264 wuauolts.exe 43 PID 2264 wrote to memory of 2836 2264 wuauolts.exe 43 PID 2264 wrote to memory of 2836 2264 wuauolts.exe 43 PID 2836 wrote to memory of 1956 2836 wuauolts.exe 44 PID 2836 wrote to memory of 1956 2836 wuauolts.exe 44 PID 2836 wrote to memory of 1956 2836 wuauolts.exe 44 PID 2836 wrote to memory of 1956 2836 wuauolts.exe 44 PID 1956 wrote to memory of 1780 1956 wuauolts.exe 45 PID 1956 wrote to memory of 1780 1956 wuauolts.exe 45 PID 1956 wrote to memory of 1780 1956 wuauolts.exe 45 PID 1956 wrote to memory of 1780 1956 wuauolts.exe 45 PID 1780 wrote to memory of 2816 1780 wuauolts.exe 46 PID 1780 wrote to memory of 2816 1780 wuauolts.exe 46 PID 1780 wrote to memory of 2816 1780 wuauolts.exe 46 PID 1780 wrote to memory of 2816 1780 wuauolts.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\faa68f4cac61953b31bd4fdf8e11f765_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2816 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2804 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2628 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1228 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1300 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2172 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2124 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2060 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2088 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1368 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:912 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1152 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2080 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1724 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:928 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2216 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1584 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2248 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1440 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1016 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2996 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:560 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2240 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2232 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:344 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1856 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2212 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1464 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2292 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2056 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2712 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2788 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2684 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2652 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:536 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2424 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2924 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1960 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2916 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2932 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:948 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1776 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2396 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2464 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:880 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:1492
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:1200
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:2360
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:2660
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:2988
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:2776
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵
- Enumerates connected drives
PID:2812 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:1648
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:1872
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:2096
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:1704
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:2920
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:2036
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:1888
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:1608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:2408
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:1784
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:2792
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:2448
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:2152
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:2736
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:2564
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:2352
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:1012
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:756
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:1740
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:760
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:1124
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:1968
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:1876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:1984
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:1420
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:988
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:1696
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵
- Enumerates connected drives
PID:2800 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵
- Drops file in System32 directory
PID:580 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:588
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:2516
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:2100
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:1176
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:2724
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:1296
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:1884
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:2676
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:1396
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:1552
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:1500
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:2904
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:316
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵
- System Location Discovery: System Language Discovery
PID:1716 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:2184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:2648
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:1788
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:1900
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:2192
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:1624
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-