Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
54s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 05:29
Static task
static1
Behavioral task
behavioral1
Sample
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe
-
Size
73KB
-
MD5
f06bbe1de79d323f9e3c3c84791038a6
-
SHA1
7d389c23d207e7527ab7bb0468fc2e3358be2594
-
SHA256
610baffc80f6aa5117301f165f92de339bfd46bd8106b348e9dddeaeba06f1cd
-
SHA512
7603e7b3e6d0464f04f583b3fef9d1ed5e21cd668942ce0d2bdfe6194e57a5804d2615ec9847dcc14f563edc356dd1f0993271b3571a29d7d40f7eb5173af7e5
-
SSDEEP
1536:9W64HFoPLB1us1/0CVCLdiMBXshbZ7+d4Xa2DYVmu+E3IjwvOLO18w00C:X4HqD1/0t8BZad4q2D+my3IjwGy18e
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1972 mdmi386.exe 1520 mdmi386.exe 4000 mdmi386.exe 4220 mdmi386.exe 3144 mdmi386.exe 3572 mdmi386.exe 5000 mdmi386.exe 1620 mdmi386.exe 3380 mdmi386.exe 260 mdmi386.exe 3328 mdmi386.exe 1968 mdmi386.exe 4524 mdmi386.exe 3724 mdmi386.exe 3616 mdmi386.exe 444 mdmi386.exe 2512 mdmi386.exe 5016 mdmi386.exe 1368 mdmi386.exe 2904 mdmi386.exe 3180 mdmi386.exe 2544 mdmi386.exe 2632 mdmi386.exe 2404 mdmi386.exe 2392 mdmi386.exe 1448 mdmi386.exe 368 mdmi386.exe 1688 mdmi386.exe 1084 mdmi386.exe 3404 mdmi386.exe 3104 mdmi386.exe 2060 mdmi386.exe 4284 mdmi386.exe 5088 mdmi386.exe 1104 mdmi386.exe 4888 mdmi386.exe 4856 mdmi386.exe 3560 mdmi386.exe 1824 mdmi386.exe 620 mdmi386.exe 1708 mdmi386.exe 936 mdmi386.exe 3864 mdmi386.exe 1636 mdmi386.exe 4432 mdmi386.exe 2380 mdmi386.exe 4052 mdmi386.exe 1712 mdmi386.exe 1996 mdmi386.exe 4196 mdmi386.exe 4544 mdmi386.exe 3996 mdmi386.exe 3144 mdmi386.exe 4828 mdmi386.exe 5096 mdmi386.exe 3584 mdmi386.exe 320 mdmi386.exe 4464 mdmi386.exe 964 mdmi386.exe 3324 mdmi386.exe 996 mdmi386.exe 4824 mdmi386.exe 2056 mdmi386.exe 3088 mdmi386.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1972 5112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 91 PID 5112 wrote to memory of 1972 5112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 91 PID 5112 wrote to memory of 1972 5112 f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe 91 PID 1972 wrote to memory of 1520 1972 mdmi386.exe 92 PID 1972 wrote to memory of 1520 1972 mdmi386.exe 92 PID 1972 wrote to memory of 1520 1972 mdmi386.exe 92 PID 1520 wrote to memory of 4000 1520 mdmi386.exe 93 PID 1520 wrote to memory of 4000 1520 mdmi386.exe 93 PID 1520 wrote to memory of 4000 1520 mdmi386.exe 93 PID 4000 wrote to memory of 4220 4000 mdmi386.exe 94 PID 4000 wrote to memory of 4220 4000 mdmi386.exe 94 PID 4000 wrote to memory of 4220 4000 mdmi386.exe 94 PID 4220 wrote to memory of 3144 4220 mdmi386.exe 143 PID 4220 wrote to memory of 3144 4220 mdmi386.exe 143 PID 4220 wrote to memory of 3144 4220 mdmi386.exe 143 PID 3144 wrote to memory of 3572 3144 mdmi386.exe 96 PID 3144 wrote to memory of 3572 3144 mdmi386.exe 96 PID 3144 wrote to memory of 3572 3144 mdmi386.exe 96 PID 3572 wrote to memory of 5000 3572 mdmi386.exe 97 PID 3572 wrote to memory of 5000 3572 mdmi386.exe 97 PID 3572 wrote to memory of 5000 3572 mdmi386.exe 97 PID 5000 wrote to memory of 1620 5000 mdmi386.exe 98 PID 5000 wrote to memory of 1620 5000 mdmi386.exe 98 PID 5000 wrote to memory of 1620 5000 mdmi386.exe 98 PID 1620 wrote to memory of 3380 1620 mdmi386.exe 99 PID 1620 wrote to memory of 3380 1620 mdmi386.exe 99 PID 1620 wrote to memory of 3380 1620 mdmi386.exe 99 PID 3380 wrote to memory of 260 3380 mdmi386.exe 100 PID 3380 wrote to memory of 260 3380 mdmi386.exe 100 PID 3380 wrote to memory of 260 3380 mdmi386.exe 100 PID 260 wrote to memory of 3328 260 mdmi386.exe 101 PID 260 wrote to memory of 3328 260 mdmi386.exe 101 PID 260 wrote to memory of 3328 260 mdmi386.exe 101 PID 3328 wrote to memory of 1968 3328 mdmi386.exe 102 PID 3328 wrote to memory of 1968 3328 mdmi386.exe 102 PID 3328 wrote to memory of 1968 3328 mdmi386.exe 102 PID 1968 wrote to memory of 4524 1968 mdmi386.exe 103 PID 1968 wrote to memory of 4524 1968 mdmi386.exe 103 PID 1968 wrote to memory of 4524 1968 mdmi386.exe 103 PID 4524 wrote to memory of 3724 4524 mdmi386.exe 104 PID 4524 wrote to memory of 3724 4524 mdmi386.exe 104 PID 4524 wrote to memory of 3724 4524 mdmi386.exe 104 PID 3724 wrote to memory of 3616 3724 mdmi386.exe 105 PID 3724 wrote to memory of 3616 3724 mdmi386.exe 105 PID 3724 wrote to memory of 3616 3724 mdmi386.exe 105 PID 3616 wrote to memory of 444 3616 mdmi386.exe 106 PID 3616 wrote to memory of 444 3616 mdmi386.exe 106 PID 3616 wrote to memory of 444 3616 mdmi386.exe 106 PID 444 wrote to memory of 2512 444 mdmi386.exe 107 PID 444 wrote to memory of 2512 444 mdmi386.exe 107 PID 444 wrote to memory of 2512 444 mdmi386.exe 107 PID 2512 wrote to memory of 5016 2512 mdmi386.exe 108 PID 2512 wrote to memory of 5016 2512 mdmi386.exe 108 PID 2512 wrote to memory of 5016 2512 mdmi386.exe 108 PID 5016 wrote to memory of 1368 5016 mdmi386.exe 109 PID 5016 wrote to memory of 1368 5016 mdmi386.exe 109 PID 5016 wrote to memory of 1368 5016 mdmi386.exe 109 PID 1368 wrote to memory of 2904 1368 mdmi386.exe 110 PID 1368 wrote to memory of 2904 1368 mdmi386.exe 110 PID 1368 wrote to memory of 2904 1368 mdmi386.exe 110 PID 2904 wrote to memory of 3180 2904 mdmi386.exe 111 PID 2904 wrote to memory of 3180 2904 mdmi386.exe 111 PID 2904 wrote to memory of 3180 2904 mdmi386.exe 111 PID 3180 wrote to memory of 2544 3180 mdmi386.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f06bbe1de79d323f9e3c3c84791038a6_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"23⤵
- Executes dropped EXE
PID:2544 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"24⤵
- Executes dropped EXE
PID:2632 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"25⤵
- Executes dropped EXE
PID:2404 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"26⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2392 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"27⤵
- Executes dropped EXE
PID:1448 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"28⤵
- Executes dropped EXE
PID:368 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"29⤵
- Executes dropped EXE
PID:1688 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"30⤵
- Executes dropped EXE
PID:1084 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"31⤵
- Executes dropped EXE
PID:3404 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"32⤵
- Executes dropped EXE
PID:3104 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"33⤵
- Executes dropped EXE
PID:2060 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"34⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"35⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"36⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"37⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4888 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"38⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"39⤵
- Executes dropped EXE
PID:3560 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"40⤵
- Executes dropped EXE
PID:1824 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"41⤵
- Executes dropped EXE
PID:620 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"42⤵
- Executes dropped EXE
PID:1708 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"43⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"44⤵
- Executes dropped EXE
PID:3864 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"45⤵
- Executes dropped EXE
PID:1636 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"46⤵
- Executes dropped EXE
PID:4432 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"47⤵
- Executes dropped EXE
PID:2380 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"48⤵
- Executes dropped EXE
PID:4052 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"49⤵
- Executes dropped EXE
PID:1712 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"50⤵
- Executes dropped EXE
PID:1996 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"51⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"52⤵
- Executes dropped EXE
PID:4544 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"53⤵
- Executes dropped EXE
PID:3996 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"54⤵
- Executes dropped EXE
PID:3144 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"55⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4828 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"56⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5096 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"57⤵
- Executes dropped EXE
PID:3584 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"58⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:320 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"59⤵
- Executes dropped EXE
PID:4464 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"60⤵
- Executes dropped EXE
PID:964 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"61⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"62⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:996 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"63⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"64⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"65⤵
- Executes dropped EXE
PID:3088 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"66⤵PID:1796
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"67⤵PID:3500
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"68⤵PID:1568
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"69⤵PID:1736
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"70⤵PID:2196
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"71⤵PID:1848
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"72⤵PID:2220
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"73⤵PID:1944
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"74⤵PID:3696
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"75⤵PID:4440
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"76⤵PID:4444
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"77⤵PID:3044
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"78⤵PID:3788
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"79⤵PID:1084
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"80⤵
- Drops file in System32 directory
PID:3800 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"81⤵PID:2620
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"82⤵PID:4120
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"83⤵PID:3104
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"84⤵PID:3920
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"85⤵PID:1116
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"86⤵PID:4908
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"87⤵PID:3148
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"88⤵PID:2892
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"89⤵PID:4068
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"90⤵PID:1384
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"91⤵PID:2180
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"92⤵PID:2348
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"93⤵PID:1524
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"94⤵PID:1824
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"95⤵PID:4264
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"96⤵PID:2304
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"97⤵
- Drops file in System32 directory
PID:4584 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"98⤵PID:4016
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"99⤵PID:3872
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"100⤵PID:4480
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"101⤵PID:3964
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"102⤵PID:2380
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"103⤵PID:736
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"104⤵PID:4764
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"105⤵PID:1520
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"106⤵PID:4000
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"107⤵PID:916
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"108⤵PID:4876
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"109⤵PID:4320
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"110⤵PID:3132
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"111⤵PID:1536
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"112⤵PID:1620
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"113⤵PID:232
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"114⤵PID:5096
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"115⤵PID:2944
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"116⤵PID:2452
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"117⤵PID:4464
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"118⤵PID:840
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"119⤵PID:3176
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"120⤵
- Drops file in System32 directory
PID:3520 -
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"121⤵PID:3616
-
C:\Windows\SysWOW64\mdmi386.exe"C:\Windows\system32\mdmi386.exe"122⤵PID:444
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-