Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 15:20
Static task
static1
Behavioral task
behavioral1
Sample
f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe
-
Size
65KB
-
MD5
f15f1fb8ab2d6ead112074ae8c23650f
-
SHA1
99f5a0743dd1af86b5c9be98c832dd1cbd24e0ae
-
SHA256
55b708133309478c9bb476a2cf578b1224631d71c31c92edb80bd781077c145d
-
SHA512
408a864a1ad159313250c7ea971dfc14989d0a8b2104a6e02b7b94c503ad2db7c4fee3154c40f32f2c2220d3851692568ea5e94b253004d22014082f162956b0
-
SSDEEP
1536:FoaAunefL4NUI5nn42pkx+YoUXHRmI4ZGLWHxgNHJWBv5:FbAuGMNUIlnBY/XII40aGpWBR
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4816 mdmi386.exe 5084 mdmi386.exe 1280 mdmi386.exe 3500 mdmi386.exe 620 mdmi386.exe 3536 mdmi386.exe 2388 mdmi386.exe 2360 mdmi386.exe 4784 mdmi386.exe 2684 mdmi386.exe 1788 mdmi386.exe 1996 mdmi386.exe 2528 mdmi386.exe 5012 mdmi386.exe 3720 mdmi386.exe 3640 mdmi386.exe 1688 mdmi386.exe 2088 mdmi386.exe 928 mdmi386.exe 4536 mdmi386.exe 2408 mdmi386.exe 4432 mdmi386.exe 8 mdmi386.exe 3108 mdmi386.exe 5084 mdmi386.exe 5092 mdmi386.exe 3504 mdmi386.exe 1408 mdmi386.exe 3536 mdmi386.exe 1320 mdmi386.exe 3028 mdmi386.exe 2004 mdmi386.exe 5080 mdmi386.exe 4464 mdmi386.exe 532 mdmi386.exe 2528 mdmi386.exe 5012 mdmi386.exe 548 mdmi386.exe 4720 mdmi386.exe 1120 mdmi386.exe 2148 mdmi386.exe 4832 mdmi386.exe 1104 mdmi386.exe 4172 mdmi386.exe 2788 mdmi386.exe 2756 mdmi386.exe 4724 mdmi386.exe 2116 mdmi386.exe 3500 mdmi386.exe 1036 mdmi386.exe 5112 mdmi386.exe 1512 mdmi386.exe 3852 mdmi386.exe 2560 mdmi386.exe 2712 mdmi386.exe 872 mdmi386.exe 1732 mdmi386.exe 224 mdmi386.exe 2400 mdmi386.exe 412 mdmi386.exe 4444 mdmi386.exe 836 mdmi386.exe 4856 mdmi386.exe 3128 mdmi386.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4900 wrote to memory of 4816 4900 f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe 93 PID 4900 wrote to memory of 4816 4900 f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe 93 PID 4900 wrote to memory of 4816 4900 f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe 93 PID 4816 wrote to memory of 5084 4816 mdmi386.exe 94 PID 4816 wrote to memory of 5084 4816 mdmi386.exe 94 PID 4816 wrote to memory of 5084 4816 mdmi386.exe 94 PID 5084 wrote to memory of 1280 5084 mdmi386.exe 95 PID 5084 wrote to memory of 1280 5084 mdmi386.exe 95 PID 5084 wrote to memory of 1280 5084 mdmi386.exe 95 PID 1280 wrote to memory of 3500 1280 mdmi386.exe 96 PID 1280 wrote to memory of 3500 1280 mdmi386.exe 96 PID 1280 wrote to memory of 3500 1280 mdmi386.exe 96 PID 3500 wrote to memory of 620 3500 mdmi386.exe 97 PID 3500 wrote to memory of 620 3500 mdmi386.exe 97 PID 3500 wrote to memory of 620 3500 mdmi386.exe 97 PID 620 wrote to memory of 3536 620 mdmi386.exe 98 PID 620 wrote to memory of 3536 620 mdmi386.exe 98 PID 620 wrote to memory of 3536 620 mdmi386.exe 98 PID 3536 wrote to memory of 2388 3536 mdmi386.exe 99 PID 3536 wrote to memory of 2388 3536 mdmi386.exe 99 PID 3536 wrote to memory of 2388 3536 mdmi386.exe 99 PID 2388 wrote to memory of 2360 2388 mdmi386.exe 100 PID 2388 wrote to memory of 2360 2388 mdmi386.exe 100 PID 2388 wrote to memory of 2360 2388 mdmi386.exe 100 PID 2360 wrote to memory of 4784 2360 mdmi386.exe 101 PID 2360 wrote to memory of 4784 2360 mdmi386.exe 101 PID 2360 wrote to memory of 4784 2360 mdmi386.exe 101 PID 4784 wrote to memory of 2684 4784 mdmi386.exe 102 PID 4784 wrote to memory of 2684 4784 mdmi386.exe 102 PID 4784 wrote to memory of 2684 4784 mdmi386.exe 102 PID 2684 wrote to memory of 1788 2684 mdmi386.exe 103 PID 2684 wrote to memory of 1788 2684 mdmi386.exe 103 PID 2684 wrote to memory of 1788 2684 mdmi386.exe 103 PID 1788 wrote to memory of 1996 1788 mdmi386.exe 104 PID 1788 wrote to memory of 1996 1788 mdmi386.exe 104 PID 1788 wrote to memory of 1996 1788 mdmi386.exe 104 PID 1996 wrote to memory of 2528 1996 mdmi386.exe 105 PID 1996 wrote to memory of 2528 1996 mdmi386.exe 105 PID 1996 wrote to memory of 2528 1996 mdmi386.exe 105 PID 2528 wrote to memory of 5012 2528 mdmi386.exe 106 PID 2528 wrote to memory of 5012 2528 mdmi386.exe 106 PID 2528 wrote to memory of 5012 2528 mdmi386.exe 106 PID 5012 wrote to memory of 3720 5012 mdmi386.exe 107 PID 5012 wrote to memory of 3720 5012 mdmi386.exe 107 PID 5012 wrote to memory of 3720 5012 mdmi386.exe 107 PID 3720 wrote to memory of 3640 3720 mdmi386.exe 108 PID 3720 wrote to memory of 3640 3720 mdmi386.exe 108 PID 3720 wrote to memory of 3640 3720 mdmi386.exe 108 PID 3640 wrote to memory of 1688 3640 mdmi386.exe 109 PID 3640 wrote to memory of 1688 3640 mdmi386.exe 109 PID 3640 wrote to memory of 1688 3640 mdmi386.exe 109 PID 1688 wrote to memory of 2088 1688 mdmi386.exe 110 PID 1688 wrote to memory of 2088 1688 mdmi386.exe 110 PID 1688 wrote to memory of 2088 1688 mdmi386.exe 110 PID 2088 wrote to memory of 928 2088 mdmi386.exe 111 PID 2088 wrote to memory of 928 2088 mdmi386.exe 111 PID 2088 wrote to memory of 928 2088 mdmi386.exe 111 PID 928 wrote to memory of 4536 928 mdmi386.exe 112 PID 928 wrote to memory of 4536 928 mdmi386.exe 112 PID 928 wrote to memory of 4536 928 mdmi386.exe 112 PID 4536 wrote to memory of 2408 4536 mdmi386.exe 113 PID 4536 wrote to memory of 2408 4536 mdmi386.exe 113 PID 4536 wrote to memory of 2408 4536 mdmi386.exe 113 PID 2408 wrote to memory of 4432 2408 mdmi386.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f15f1fb8ab2d6ead112074ae8c23650f_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"23⤵
- Executes dropped EXE
PID:4432 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"24⤵
- Executes dropped EXE
PID:8 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"25⤵
- Executes dropped EXE
PID:3108 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"26⤵
- Executes dropped EXE
PID:5084 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"27⤵
- Executes dropped EXE
PID:5092 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"28⤵
- Executes dropped EXE
PID:3504 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"29⤵
- Executes dropped EXE
PID:1408 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"30⤵
- Executes dropped EXE
PID:3536 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"31⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1320 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"32⤵
- Executes dropped EXE
PID:3028 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"33⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"34⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5080 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"35⤵
- Executes dropped EXE
PID:4464 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"36⤵
- Executes dropped EXE
PID:532 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"37⤵
- Executes dropped EXE
PID:2528 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"38⤵
- Executes dropped EXE
PID:5012 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"39⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"40⤵
- Executes dropped EXE
PID:4720 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"41⤵
- Executes dropped EXE
PID:1120 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"42⤵
- Executes dropped EXE
PID:2148 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"43⤵
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"44⤵
- Executes dropped EXE
PID:1104 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"45⤵
- Executes dropped EXE
PID:4172 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"46⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"47⤵
- Executes dropped EXE
PID:2756 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"48⤵
- Executes dropped EXE
PID:4724 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"49⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"50⤵
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"51⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"52⤵
- Executes dropped EXE
PID:5112 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"53⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"54⤵
- Executes dropped EXE
PID:3852 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"55⤵
- Executes dropped EXE
PID:2560 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"56⤵
- Executes dropped EXE
PID:2712 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"57⤵
- Executes dropped EXE
PID:872 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"58⤵
- Executes dropped EXE
PID:1732 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"59⤵
- Executes dropped EXE
PID:224 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"60⤵
- Executes dropped EXE
PID:2400 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"61⤵
- Executes dropped EXE
PID:412 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"62⤵
- Executes dropped EXE
PID:4444 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"63⤵
- Executes dropped EXE
PID:836 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"64⤵
- Executes dropped EXE
PID:4856 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"65⤵
- Executes dropped EXE
PID:3128 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"66⤵PID:3948
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"67⤵PID:4324
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"68⤵PID:4900
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"69⤵PID:3448
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"70⤵PID:1280
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"71⤵PID:992
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"72⤵PID:1392
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"73⤵PID:456
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"74⤵PID:4540
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"75⤵PID:1800
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"76⤵PID:1508
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"77⤵
- Drops file in System32 directory
PID:1044 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"78⤵PID:1920
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"79⤵PID:1788
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"80⤵
- Drops file in System32 directory
PID:4464 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"81⤵
- Drops file in System32 directory
PID:1996 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"82⤵PID:4384
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"83⤵PID:1792
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"84⤵PID:3640
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"85⤵PID:1124
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"86⤵PID:2088
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"87⤵PID:3068
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"88⤵PID:4588
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"89⤵PID:1104
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"90⤵PID:2356
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"91⤵PID:416
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"92⤵PID:2788
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"93⤵PID:2756
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"94⤵PID:1968
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"95⤵PID:3240
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"96⤵PID:992
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"97⤵PID:1396
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"98⤵PID:1936
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"99⤵PID:4164
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"100⤵PID:804
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"101⤵PID:912
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"102⤵
- Drops file in System32 directory
PID:3092 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"103⤵PID:4808
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"104⤵PID:1732
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"105⤵PID:224
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"106⤵
- Drops file in System32 directory
PID:5012 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"107⤵PID:400
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"108⤵PID:4444
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"109⤵PID:3104
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"110⤵PID:8
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"111⤵PID:1252
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"112⤵PID:3128
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"113⤵PID:4832
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"114⤵PID:2280
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"115⤵PID:3468
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"116⤵PID:3856
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"117⤵PID:3036
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"118⤵PID:1968
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"119⤵PID:1408
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"120⤵PID:3648
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"121⤵PID:1512
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"122⤵PID:2912
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-