f0ac3d737f450eb47df7da5825cd5e17f24df008a8ee1ac901e133088a04e968

Analysis

max time kernel
158s
max time network
131s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 09:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b716b755248d5784df33e2f6f21aa979.exe
Size

39KB
MD5

b716b755248d5784df33e2f6f21aa979
SHA1

6334cbac13f76896c674d50d3ad5c7fcc7de4ab6
SHA256

f0ac3d737f450eb47df7da5825cd5e17f24df008a8ee1ac901e133088a04e968
SHA512

f14e71a25188fda76bf02170f99474aa643d6076ac4644f2ffe0b61feddaaf22d020f50a13a88304a76aef7afee68d644a93ad28afd537c331242d4e6c53ccfb
SSDEEP

768:gleasIfgzZmRCQfI1goVStho4DTslbPfsIm7jFbyULcNENz:q1sTdmRCQg1/VSrGlbs57j1hcNy

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2524	b716b755248d5784df33e2f6f21aa979.exe
2640	mdm.exe
2556	mdm.exe
2716	mdm.exe
2848	mdm.exe
2376	mdm.exe
2436	mdm.exe
1268	mdm.exe
2676	mdm.exe
2168	mdm.exe
2748	mdm.exe
2772	mdm.exe
1580	mdm.exe
2348	mdm.exe
804	mdm.exe
436	mdm.exe
1916	mdm.exe
1740	mdm.exe
1524	mdm.exe
2968	mdm.exe
2036	mdm.exe
1500	mdm.exe
3052	mdm.exe
2144	mdm.exe
2900	mdm.exe
1864	mdm.exe
1308	mdm.exe
788	mdm.exe
2332	mdm.exe
1552	mdm.exe
1244	mdm.exe
1108	mdm.exe
1664	mdm.exe
1784	mdm.exe
916	mdm.exe
2232	mdm.exe
2224	mdm.exe
1492	mdm.exe
2084	mdm.exe
2124	mdm.exe
872	mdm.exe
2052	mdm.exe
1728	mdm.exe
2040	mdm.exe
3020	mdm.exe
1608	mdm.exe
2560	mdm.exe
2584	mdm.exe
2576	mdm.exe
3064	mdm.exe
2708	mdm.exe
1700	mdm.exe
2716	mdm.exe
2444	mdm.exe
2496	mdm.exe
2960	mdm.exe
1160	mdm.exe
2756	mdm.exe
2752	mdm.exe
2800	mdm.exe
2796	mdm.exe
1676	mdm.exe
1576	mdm.exe
2388	mdm.exe

Loads dropped DLL 64 IoCs

pid	Process
2972	b716b755248d5784df33e2f6f21aa979.exe
2524	b716b755248d5784df33e2f6f21aa979.exe
2524	b716b755248d5784df33e2f6f21aa979.exe
2640	mdm.exe
2556	mdm.exe
2556	mdm.exe
2716	mdm.exe
2848	mdm.exe
2848	mdm.exe
2376	mdm.exe
2436	mdm.exe
2436	mdm.exe
1268	mdm.exe
2676	mdm.exe
2676	mdm.exe
2168	mdm.exe
2748	mdm.exe
2748	mdm.exe
2772	mdm.exe
1580	mdm.exe
1580	mdm.exe
2348	mdm.exe
804	mdm.exe
804	mdm.exe
436	mdm.exe
1916	mdm.exe
1916	mdm.exe
1524	mdm.exe
1524	mdm.exe
2036	mdm.exe
2036	mdm.exe
3052	mdm.exe
3052	mdm.exe
2900	mdm.exe
2900	mdm.exe
1308	mdm.exe
1308	mdm.exe
2332	mdm.exe
2332	mdm.exe
1244	mdm.exe
1244	mdm.exe
1664	mdm.exe
1664	mdm.exe
916	mdm.exe
916	mdm.exe
2224	mdm.exe
2224	mdm.exe
2084	mdm.exe
2084	mdm.exe
872	mdm.exe
872	mdm.exe
1728	mdm.exe
1728	mdm.exe
3020	mdm.exe
3020	mdm.exe
2560	mdm.exe
2560	mdm.exe
2576	mdm.exe
2576	mdm.exe
2708	mdm.exe
2708	mdm.exe
2716	mdm.exe
2716	mdm.exe
2496	mdm.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-8-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2524-9-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2524-11-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2556-30-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2556-32-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2848-48-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2436-59-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2436-63-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2676-78-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2676-75-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2748-91-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1580-106-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/804-120-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/804-128-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1916-141-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1524-155-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2036-165-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/3052-179-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2900-195-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1308-209-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2332-217-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1244-228-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1664-239-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/916-247-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2224-257-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2084-267-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/872-277-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1728-289-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/3020-297-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/3020-302-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2560-308-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2576-318-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2708-330-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2716-338-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2496-348-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2496-351-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1160-359-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2752-371-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2796-381-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1576-389-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1576-393-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1824-402-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1560-410-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1560-413-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2856-423-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1472-431-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1736-441-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1736-443-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1484-454-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/844-465-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1788-473-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1176-484-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1376-493-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2868-504-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2924-514-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2236-524-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2308-535-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2672-546-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2112-556-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/2512-565-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/764-575-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1984-585-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1180-595-0x0000000000400000-0x000000000044A000-memory.dmp	upx
behavioral1/memory/1528-605-0x0000000000400000-0x000000000044A000-memory.dmp	upx

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File created	C:\Windows\SysWOW64\mdm.exe	mdm.exe
File opened for modification	C:\Windows\SysWOW64\mdm.exe	mdm.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2640 set thread context of 2556	2640	mdm.exe	29
PID 2716 set thread context of 2848	2716	mdm.exe	31
PID 2376 set thread context of 2436	2376	mdm.exe	33
PID 1268 set thread context of 2676	1268	mdm.exe	35
PID 2168 set thread context of 2748	2168	mdm.exe	37
PID 2772 set thread context of 1580	2772	mdm.exe	39
PID 2348 set thread context of 804	2348	mdm.exe	41
PID 436 set thread context of 1916	436	mdm.exe	43
PID 1740 set thread context of 1524	1740	mdm.exe	45
PID 2968 set thread context of 2036	2968	mdm.exe	47
PID 1500 set thread context of 3052	1500	mdm.exe	49
PID 2144 set thread context of 2900	2144	mdm.exe	51
PID 1864 set thread context of 1308	1864	mdm.exe	53
PID 788 set thread context of 2332	788	mdm.exe	55
PID 1552 set thread context of 1244	1552	mdm.exe	57
PID 1108 set thread context of 1664	1108	mdm.exe	59
PID 1784 set thread context of 916	1784	mdm.exe	61
PID 2232 set thread context of 2224	2232	mdm.exe	63
PID 1492 set thread context of 2084	1492	mdm.exe	65
PID 2124 set thread context of 872	2124	mdm.exe	67
PID 2052 set thread context of 1728	2052	mdm.exe	69
PID 2040 set thread context of 3020	2040	mdm.exe	71
PID 1608 set thread context of 2560	1608	mdm.exe	73
PID 2584 set thread context of 2576	2584	mdm.exe	75
PID 3064 set thread context of 2708	3064	mdm.exe	77
PID 1700 set thread context of 2716	1700	mdm.exe	79
PID 2444 set thread context of 2496	2444	mdm.exe	81
PID 2960 set thread context of 1160	2960	mdm.exe	83
PID 2756 set thread context of 2752	2756	mdm.exe	85
PID 2800 set thread context of 2796	2800	mdm.exe	87
PID 1676 set thread context of 1576	1676	mdm.exe	89
PID 2388 set thread context of 1824	2388	mdm.exe	91
PID 1060 set thread context of 1560	1060	mdm.exe	93
PID 632 set thread context of 2856	632	mdm.exe	95
PID 1460 set thread context of 1472	1460	mdm.exe	97
PID 1768 set thread context of 1736	1768	mdm.exe	99
PID 2000 set thread context of 1484	2000	mdm.exe	101
PID 2060 set thread context of 844	2060	mdm.exe	103
PID 1096 set thread context of 1788	1096	mdm.exe	105
PID 1724 set thread context of 1176	1724	mdm.exe	107
PID 1540 set thread context of 1376	1540	mdm.exe	109
PID 1628 set thread context of 2868	1628	mdm.exe	111
PID 1040 set thread context of 2924	1040	mdm.exe	113
PID 3036 set thread context of 2236	3036	mdm.exe	115
PID 2056 set thread context of 2308	2056	mdm.exe	117
PID 1804 set thread context of 2672	1804	mdm.exe	121
PID 2784 set thread context of 2112	2784	mdm.exe	123
PID 2800 set thread context of 2512	2800	mdm.exe	125
PID 2788 set thread context of 764	2788	mdm.exe	127
PID 1800 set thread context of 1984	1800	mdm.exe	129
PID 1060 set thread context of 1180	1060	mdm.exe	131
PID 2380 set thread context of 1528	2380	mdm.exe	133
PID 1460 set thread context of 2844	1460	mdm.exe	135
PID 2888 set thread context of 1320	2888	mdm.exe	137
PID 3044 set thread context of 2156	3044	mdm.exe	139
PID 2400 set thread context of 1352	2400	mdm.exe	141
PID 2216 set thread context of 1380	2216	mdm.exe	143
PID 344 set thread context of 1840	344	mdm.exe	145
PID 1028 set thread context of 1108	1028	mdm.exe	147
PID 904 set thread context of 3032	904	mdm.exe	149
PID 776 set thread context of 1704	776	mdm.exe	151
PID 2280 set thread context of 984	2280	mdm.exe	153
PID 2860 set thread context of 2064	2860	mdm.exe	155

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2972 wrote to memory of 2524	2972	b716b755248d5784df33e2f6f21aa979.exe	27
PID 2524 wrote to memory of 2640	2524	b716b755248d5784df33e2f6f21aa979.exe	28
PID 2524 wrote to memory of 2640	2524	b716b755248d5784df33e2f6f21aa979.exe	28
PID 2524 wrote to memory of 2640	2524	b716b755248d5784df33e2f6f21aa979.exe	28
PID 2524 wrote to memory of 2640	2524	b716b755248d5784df33e2f6f21aa979.exe	28
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2640 wrote to memory of 2556	2640	mdm.exe	29
PID 2556 wrote to memory of 2716	2556	mdm.exe	30
PID 2556 wrote to memory of 2716	2556	mdm.exe	30
PID 2556 wrote to memory of 2716	2556	mdm.exe	30
PID 2556 wrote to memory of 2716	2556	mdm.exe	30
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2716 wrote to memory of 2848	2716	mdm.exe	31
PID 2848 wrote to memory of 2376	2848	mdm.exe	32
PID 2848 wrote to memory of 2376	2848	mdm.exe	32
PID 2848 wrote to memory of 2376	2848	mdm.exe	32
PID 2848 wrote to memory of 2376	2848	mdm.exe	32
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2376 wrote to memory of 2436	2376	mdm.exe	33
PID 2436 wrote to memory of 1268	2436	mdm.exe	34
PID 2436 wrote to memory of 1268	2436	mdm.exe	34
PID 2436 wrote to memory of 1268	2436	mdm.exe	34
PID 2436 wrote to memory of 1268	2436	mdm.exe	34
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 1268 wrote to memory of 2676	1268	mdm.exe	35
PID 2676 wrote to memory of 2168	2676	mdm.exe	36
PID 2676 wrote to memory of 2168	2676	mdm.exe	36
PID 2676 wrote to memory of 2168	2676	mdm.exe	36
PID 2676 wrote to memory of 2168	2676	mdm.exe	36
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2168 wrote to memory of 2748	2168	mdm.exe	37
PID 2748 wrote to memory of 2772	2748	mdm.exe	38
PID 2748 wrote to memory of 2772	2748	mdm.exe	38
PID 2748 wrote to memory of 2772	2748	mdm.exe	38
PID 2748 wrote to memory of 2772	2748	mdm.exe	38
PID 2772 wrote to memory of 1580	2772	mdm.exe	39
PID 2772 wrote to memory of 1580	2772	mdm.exe	39
PID 2772 wrote to memory of 1580	2772	mdm.exe	39
PID 2772 wrote to memory of 1580	2772	mdm.exe	39

C:\Users\Admin\AppData\Local\Temp\b716b755248d5784df33e2f6f21aa979.exe
"C:\Users\Admin\AppData\Local\Temp\b716b755248d5784df33e2f6f21aa979.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Users\Admin\AppData\Local\Temp\b716b755248d5784df33e2f6f21aa979.exe
  C:\Users\Admin\AppData\Local\Temp\b716b755248d5784df33e2f6f21aa979.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\mdm.exe
    "C:\Windows\system32\mdm.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\mdm.exe
      C:\Windows\SysWOW64\mdm.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2716
      - C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2436
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2168
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        14⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1580
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        15⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:2348
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        16⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:804
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        17⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        
        PID:436
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        18⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1916
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1740
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        20⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1524
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        21⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2968
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        22⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1500
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        24⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:3052
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2144
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        26⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2900
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1864
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        28⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1308
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        29⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:788
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        30⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2332
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        31⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1552
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        32⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1244
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        33⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1108
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        34⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1664
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        35⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1784
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        36⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:916
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2232
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        38⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2224
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1492
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        40⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2084
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        41⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2124
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        42⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:872
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2052
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        44⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1728
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        45⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2040
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        46⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3020
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        47⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1608
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        48⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2560
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        49⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2584
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        50⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2576
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:3064
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        52⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2708
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1700
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        54⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2716
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2444
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        56⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        57⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2960
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        58⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2756
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        60⤵
        Executes dropped EXE
        
        PID:2752
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2800
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        62⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        63⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1676
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        64⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2388
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        66⤵
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        67⤵
        Suspicious use of SetThreadContext
        
        PID:1060
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        68⤵
        Drops file in System32 directory
        
        PID:1560
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        69⤵
        Suspicious use of SetThreadContext
        
        PID:632
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        70⤵
        Drops file in System32 directory
        
        PID:2856
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        71⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1460
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        72⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        73⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1768
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        74⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        75⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2000
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        76⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        77⤵
        Suspicious use of SetThreadContext
        
        PID:2060
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        78⤵
        
        PID:844
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        79⤵
        Suspicious use of SetThreadContext
        
        PID:1096
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        80⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        81⤵
        Suspicious use of SetThreadContext
        
        PID:1724
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        82⤵
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        83⤵
        Suspicious use of SetThreadContext
        
        PID:1540
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        84⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        85⤵
        Suspicious use of SetThreadContext
        
        PID:1628
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        86⤵
        Drops file in System32 directory
        
        PID:2868
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        87⤵
        Suspicious use of SetThreadContext
        
        PID:1040
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        88⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        89⤵
        Suspicious use of SetThreadContext
        
        PID:3036
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        90⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        91⤵
        Suspicious use of SetThreadContext
        
        PID:2056
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        92⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        93⤵
        Suspicious use of SetThreadContext
        
        PID:1804
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        94⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        95⤵
        Suspicious use of SetThreadContext
        
        PID:2784
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        96⤵
        Drops file in System32 directory
        
        PID:2112
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        97⤵
        Suspicious use of SetThreadContext
        
        PID:2800
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        98⤵
        Drops file in System32 directory
        
        PID:2512
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        99⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2788
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        100⤵
        
        PID:764
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        101⤵
        Suspicious use of SetThreadContext
        
        PID:1800
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        102⤵
        Drops file in System32 directory
        
        PID:1984
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        103⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1060
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        104⤵
        Drops file in System32 directory
        
        PID:1180
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        105⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2380
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        106⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        107⤵
        Suspicious use of SetThreadContext
        
        PID:1460
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        108⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        109⤵
        Suspicious use of SetThreadContext
        
        PID:2888
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        110⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        111⤵
        Suspicious use of SetThreadContext
        
        PID:3044
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        112⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        113⤵
        Suspicious use of SetThreadContext
        
        PID:2400
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        114⤵
        Drops file in System32 directory
        
        PID:1352
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        115⤵
        Suspicious use of SetThreadContext
        
        PID:2216
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        116⤵
        Drops file in System32 directory
        
        PID:1380
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        117⤵
        Suspicious use of SetThreadContext
        
        PID:344
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        118⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        119⤵
        Suspicious use of SetThreadContext
        
        PID:1028
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        120⤵
        Drops file in System32 directory
        
        PID:1108
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        121⤵
        Suspicious use of SetThreadContext
        
        PID:904
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        122⤵
        Drops file in System32 directory
        
        PID:3032
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        123⤵
        Suspicious use of SetThreadContext
        
        PID:776
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        124⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        125⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2280
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        126⤵
        
        PID:984
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        127⤵
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:2860
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        128⤵
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        129⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        130⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        131⤵
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        132⤵
        Drops file in System32 directory
        
        PID:2684
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        133⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        134⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        135⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        136⤵
        
        PID:556
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        137⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        138⤵
        
        PID:524
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        139⤵
        Drops file in System32 directory
        
        PID:2460
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        140⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        141⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        142⤵
        
        PID:924
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        143⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        144⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        145⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        146⤵
        Drops file in System32 directory
        
        PID:2960
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        147⤵
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        148⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        149⤵
        Drops file in System32 directory
        
        PID:892
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        150⤵
        
        PID:656
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        151⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        152⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        153⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        154⤵
        Drops file in System32 directory
        
        PID:588
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        155⤵
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        156⤵
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        157⤵
        
        PID:832
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        158⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        159⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        160⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        161⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        162⤵
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        163⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        164⤵
        Drops file in System32 directory
        
        PID:1592
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        165⤵
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        166⤵
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        167⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        168⤵
        Drops file in System32 directory
        
        PID:1364
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        169⤵
        
        PID:344
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        170⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        171⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        172⤵
        Drops file in System32 directory
        
        PID:1828
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        173⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        174⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        175⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        176⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        177⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        178⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        179⤵
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        180⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        181⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        182⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        183⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        184⤵
        Drops file in System32 directory
        
        PID:1340
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        185⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        186⤵
        Drops file in System32 directory
        
        PID:2640
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        187⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        188⤵
        Drops file in System32 directory
        
        PID:2832
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        189⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        190⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        191⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        192⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        193⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        194⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        195⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        196⤵
        
        PID:988
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        197⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        198⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        199⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        200⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        201⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        202⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        203⤵
        
        PID:868
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        204⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        205⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        206⤵
        
        PID:560
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        207⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        208⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        209⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        210⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        211⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        212⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        213⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        214⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        215⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        216⤵
        
        PID:292
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        217⤵
        
        PID:344
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        218⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        219⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        220⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        221⤵
        
        PID:944
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        222⤵
        
        PID:2116
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        223⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        224⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        225⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        226⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        227⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        228⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        229⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        230⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        231⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        232⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        233⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        234⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        235⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        236⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        237⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        238⤵
        
        PID:108
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        239⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        240⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        241⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        242⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        243⤵
        
        PID:368
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        244⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        245⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        246⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        247⤵
        
        PID:632
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        248⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        249⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        250⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        251⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        252⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        253⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        254⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        255⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        256⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        257⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        258⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        259⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        260⤵
        
        PID:912
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        261⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        262⤵
        
        PID:604
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        263⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        264⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        265⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        266⤵
        
        PID:376
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        267⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        268⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        269⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        270⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        271⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        272⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        273⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        274⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        275⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        276⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        277⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        278⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        279⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        280⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        281⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        282⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        283⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        284⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        285⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        286⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        287⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        288⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        289⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        290⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        291⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        292⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        293⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        294⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        295⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        296⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        297⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        298⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        299⤵
        
        PID:1872
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        300⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        301⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        302⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        303⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        304⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        305⤵
        
        PID:888
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        306⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        307⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        308⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        309⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        310⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        311⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        312⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        313⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        314⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        315⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        316⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        317⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        318⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        319⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        320⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        321⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        322⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        323⤵
        
        PID:584
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        324⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        325⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        326⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        327⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        328⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        329⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        330⤵
        
        PID:832
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        331⤵
        
        PID:836
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        332⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        333⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        334⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        335⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        336⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        337⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        338⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        339⤵
        
        PID:1964
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        340⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        341⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        342⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        343⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        344⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        345⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        346⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        347⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        348⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        349⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        350⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        351⤵
        
        PID:928
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        352⤵
        
        PID:700
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        353⤵
        
        PID:940
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        354⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        355⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        356⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\mdm.exe
        
        "C:\Windows\system32\mdm.exe"
        357⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\mdm.exe
        
        C:\Windows\SysWOW64\mdm.exe
        358⤵
        
        PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\b716b755248d5784df33e2f6f21aa979.exe

Filesize
39KB

MD5
b716b755248d5784df33e2f6f21aa979

SHA1
6334cbac13f76896c674d50d3ad5c7fcc7de4ab6

SHA256
f0ac3d737f450eb47df7da5825cd5e17f24df008a8ee1ac901e133088a04e968

SHA512
f14e71a25188fda76bf02170f99474aa643d6076ac4644f2ffe0b61feddaaf22d020f50a13a88304a76aef7afee68d644a93ad28afd537c331242d4e6c53ccfb

Download Submit
memory/764-575-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/804-128-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/804-120-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/844-465-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/872-277-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/916-247-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1160-359-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1176-526-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1176-484-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1180-595-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1244-228-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1308-209-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1376-493-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1472-431-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1484-454-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1524-155-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1528-605-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1560-413-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1560-410-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1576-389-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1576-393-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1580-106-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1664-239-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1728-289-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1736-441-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1736-443-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1788-473-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1824-402-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1916-141-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/1984-585-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2036-165-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2084-267-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2112-556-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2224-257-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2236-524-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2308-535-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2332-217-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2436-59-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2436-63-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2496-348-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2496-351-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2512-565-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2524-9-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2524-8-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2524-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2524-11-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2524-3-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2556-32-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2556-30-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2560-308-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2576-318-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2672-546-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2676-78-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2676-75-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2708-330-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2716-338-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2748-91-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2752-371-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2796-381-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2844-615-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2844-618-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2848-48-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2856-423-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2868-527-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2868-504-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2900-195-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2924-528-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/2924-514-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3020-302-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3020-297-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download
memory/3052-179-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download