Analysis
-
max time kernel
136s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/06/2024, 21:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe
Resource
win7-20240611-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe
Resource
win10v2004-20240508-en
3 signatures
150 seconds
General
-
Target
0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe
-
Size
65KB
-
MD5
0f93c52a235fb55d4e5f57dc7595bf7e
-
SHA1
4211260622e414c8e5e05f39af18d6fd0add2e4c
-
SHA256
c38db68986887ee8f431365cc15f8e3c8b43452f689650be9a9e944629c97e40
-
SHA512
6fa17a25c3b8bfd5b7b093890aa407bef39b9dcdee98de1a381e6fc4434c2d40be9522a48fe712a1fb006fd154b22a51dc3cbebd9a5cd3b98c8c73c42455fd4c
-
SSDEEP
1536:GBdYExx4jUcKzm1R8XLQK0DYcZvX5Sgr6FUnUEfAR6g4:GLYExx4jUcKqn87cXZggrGR74
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 392 mdmi386.exe 1352 mdmi386.exe 4808 mdmi386.exe 3180 mdmi386.exe 3096 mdmi386.exe 3148 mdmi386.exe 5060 mdmi386.exe 2424 mdmi386.exe 3760 mdmi386.exe 3352 mdmi386.exe 684 mdmi386.exe 3048 mdmi386.exe 4232 mdmi386.exe 3032 mdmi386.exe 3472 mdmi386.exe 1208 mdmi386.exe 4920 mdmi386.exe 4024 mdmi386.exe 1564 mdmi386.exe 4840 mdmi386.exe 4960 mdmi386.exe 1592 mdmi386.exe 2728 mdmi386.exe 3964 mdmi386.exe 2420 mdmi386.exe 2200 mdmi386.exe 2468 mdmi386.exe 2860 mdmi386.exe 2116 mdmi386.exe 1392 mdmi386.exe 3024 mdmi386.exe 1568 mdmi386.exe 2868 mdmi386.exe 644 mdmi386.exe 4732 mdmi386.exe 1384 mdmi386.exe 1436 mdmi386.exe 2132 mdmi386.exe 3924 mdmi386.exe 5088 mdmi386.exe 804 mdmi386.exe 1852 mdmi386.exe 3356 mdmi386.exe 3268 mdmi386.exe 632 mdmi386.exe 3904 mdmi386.exe 2456 mdmi386.exe 3380 mdmi386.exe 3668 mdmi386.exe 4180 mdmi386.exe 4004 mdmi386.exe 4304 mdmi386.exe 2496 mdmi386.exe 4548 mdmi386.exe 2792 mdmi386.exe 2804 mdmi386.exe 4328 mdmi386.exe 3508 mdmi386.exe 928 mdmi386.exe 4900 mdmi386.exe 3492 mdmi386.exe 4600 mdmi386.exe 4196 mdmi386.exe 4472 mdmi386.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 392 1696 0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe 779 PID 1696 wrote to memory of 392 1696 0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe 779 PID 1696 wrote to memory of 392 1696 0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe 779 PID 392 wrote to memory of 1352 392 mdmi386.exe 279 PID 392 wrote to memory of 1352 392 mdmi386.exe 279 PID 392 wrote to memory of 1352 392 mdmi386.exe 279 PID 1352 wrote to memory of 4808 1352 mdmi386.exe 1112 PID 1352 wrote to memory of 4808 1352 mdmi386.exe 1112 PID 1352 wrote to memory of 4808 1352 mdmi386.exe 1112 PID 4808 wrote to memory of 3180 4808 mdmi386.exe 843 PID 4808 wrote to memory of 3180 4808 mdmi386.exe 843 PID 4808 wrote to memory of 3180 4808 mdmi386.exe 843 PID 3180 wrote to memory of 3096 3180 mdmi386.exe 1046 PID 3180 wrote to memory of 3096 3180 mdmi386.exe 1046 PID 3180 wrote to memory of 3096 3180 mdmi386.exe 1046 PID 3096 wrote to memory of 3148 3096 mdmi386.exe 86 PID 3096 wrote to memory of 3148 3096 mdmi386.exe 86 PID 3096 wrote to memory of 3148 3096 mdmi386.exe 86 PID 3148 wrote to memory of 5060 3148 mdmi386.exe 87 PID 3148 wrote to memory of 5060 3148 mdmi386.exe 87 PID 3148 wrote to memory of 5060 3148 mdmi386.exe 87 PID 5060 wrote to memory of 2424 5060 mdmi386.exe 848 PID 5060 wrote to memory of 2424 5060 mdmi386.exe 848 PID 5060 wrote to memory of 2424 5060 mdmi386.exe 848 PID 2424 wrote to memory of 3760 2424 mdmi386.exe 288 PID 2424 wrote to memory of 3760 2424 mdmi386.exe 288 PID 2424 wrote to memory of 3760 2424 mdmi386.exe 288 PID 3760 wrote to memory of 3352 3760 mdmi386.exe 90 PID 3760 wrote to memory of 3352 3760 mdmi386.exe 90 PID 3760 wrote to memory of 3352 3760 mdmi386.exe 90 PID 3352 wrote to memory of 684 3352 mdmi386.exe 153 PID 3352 wrote to memory of 684 3352 mdmi386.exe 153 PID 3352 wrote to memory of 684 3352 mdmi386.exe 153 PID 684 wrote to memory of 3048 684 mdmi386.exe 1539 PID 684 wrote to memory of 3048 684 mdmi386.exe 1539 PID 684 wrote to memory of 3048 684 mdmi386.exe 1539 PID 3048 wrote to memory of 4232 3048 mdmi386.exe 1543 PID 3048 wrote to memory of 4232 3048 mdmi386.exe 1543 PID 3048 wrote to memory of 4232 3048 mdmi386.exe 1543 PID 4232 wrote to memory of 3032 4232 mdmi386.exe 94 PID 4232 wrote to memory of 3032 4232 mdmi386.exe 94 PID 4232 wrote to memory of 3032 4232 mdmi386.exe 94 PID 3032 wrote to memory of 3472 3032 mdmi386.exe 95 PID 3032 wrote to memory of 3472 3032 mdmi386.exe 95 PID 3032 wrote to memory of 3472 3032 mdmi386.exe 95 PID 3472 wrote to memory of 1208 3472 mdmi386.exe 96 PID 3472 wrote to memory of 1208 3472 mdmi386.exe 96 PID 3472 wrote to memory of 1208 3472 mdmi386.exe 96 PID 1208 wrote to memory of 4920 1208 mdmi386.exe 97 PID 1208 wrote to memory of 4920 1208 mdmi386.exe 97 PID 1208 wrote to memory of 4920 1208 mdmi386.exe 97 PID 4920 wrote to memory of 4024 4920 mdmi386.exe 160 PID 4920 wrote to memory of 4024 4920 mdmi386.exe 160 PID 4920 wrote to memory of 4024 4920 mdmi386.exe 160 PID 4024 wrote to memory of 1564 4024 mdmi386.exe 99 PID 4024 wrote to memory of 1564 4024 mdmi386.exe 99 PID 4024 wrote to memory of 1564 4024 mdmi386.exe 99 PID 1564 wrote to memory of 4840 1564 mdmi386.exe 100 PID 1564 wrote to memory of 4840 1564 mdmi386.exe 100 PID 1564 wrote to memory of 4840 1564 mdmi386.exe 100 PID 4840 wrote to memory of 4960 4840 mdmi386.exe 101 PID 4840 wrote to memory of 4960 4840 mdmi386.exe 101 PID 4840 wrote to memory of 4960 4840 mdmi386.exe 101 PID 4960 wrote to memory of 1592 4960 mdmi386.exe 235
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\0f93c52a235fb55d4e5f57dc7595bf7e_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"23⤵
- Executes dropped EXE
PID:1592 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"24⤵
- Executes dropped EXE
PID:2728 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"25⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"26⤵
- Executes dropped EXE
PID:2420 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"27⤵
- Executes dropped EXE
PID:2200 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"28⤵
- Executes dropped EXE
PID:2468 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"29⤵
- Executes dropped EXE
PID:2860 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"30⤵
- Executes dropped EXE
PID:2116 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"31⤵
- Executes dropped EXE
PID:1392 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"32⤵
- Executes dropped EXE
PID:3024 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"33⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"34⤵
- Executes dropped EXE
PID:2868 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"35⤵
- Executes dropped EXE
PID:644 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"36⤵
- Executes dropped EXE
PID:4732 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"37⤵
- Executes dropped EXE
PID:1384 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"38⤵
- Executes dropped EXE
PID:1436 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"39⤵
- Executes dropped EXE
PID:2132 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"40⤵
- Executes dropped EXE
PID:3924 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"41⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"42⤵
- Executes dropped EXE
PID:804 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"43⤵
- Executes dropped EXE
PID:1852 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"44⤵
- Executes dropped EXE
PID:3356 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"45⤵
- Executes dropped EXE
PID:3268 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"46⤵
- Executes dropped EXE
PID:632 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"47⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"48⤵
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"49⤵
- Executes dropped EXE
PID:3380 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"50⤵
- Executes dropped EXE
PID:3668 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"51⤵
- Executes dropped EXE
PID:4180 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"52⤵
- Executes dropped EXE
PID:4004 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"53⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"54⤵
- Executes dropped EXE
PID:2496 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"55⤵
- Executes dropped EXE
PID:4548 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"56⤵
- Executes dropped EXE
PID:2792 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"57⤵
- Executes dropped EXE
PID:2804 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"58⤵
- Executes dropped EXE
PID:4328 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"59⤵
- Executes dropped EXE
PID:3508 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"60⤵
- Executes dropped EXE
PID:928 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"61⤵
- Executes dropped EXE
PID:4900 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"62⤵
- Executes dropped EXE
PID:3492 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"63⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"64⤵
- Executes dropped EXE
PID:4196 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"65⤵
- Executes dropped EXE
PID:4472 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"66⤵PID:4008
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"67⤵PID:4836
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"68⤵PID:4832
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"69⤵PID:3480
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"70⤵PID:3512
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"71⤵PID:3260
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"72⤵PID:4468
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"73⤵PID:448
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"74⤵PID:684
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"75⤵PID:840
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"76⤵PID:1468
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"77⤵PID:2844
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"78⤵PID:3080
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"79⤵PID:1736
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"80⤵PID:4676
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"81⤵PID:4024
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"82⤵PID:1564
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"83⤵PID:4100
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"84⤵PID:4960
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"85⤵PID:2064
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"86⤵PID:2572
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"87⤵PID:5072
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"88⤵PID:4932
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"89⤵PID:4260
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"90⤵PID:3500
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"91⤵PID:4476
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"92⤵PID:4040
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"93⤵PID:1928
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"94⤵PID:3520
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"95⤵PID:412
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"96⤵
- Drops file in System32 directory
PID:1392 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"97⤵PID:2304
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"98⤵PID:1764
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"99⤵PID:2464
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"100⤵PID:432
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"101⤵PID:1168
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"102⤵PID:4812
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"103⤵PID:3488
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"104⤵PID:4744
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"105⤵PID:4584
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"106⤵PID:2952
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"107⤵PID:2056
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"108⤵PID:4248
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"109⤵PID:5044
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"110⤵PID:1064
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"111⤵PID:3088
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"112⤵PID:4996
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"113⤵PID:2876
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"114⤵PID:3532
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"115⤵PID:2296
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"116⤵PID:1524
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"117⤵PID:2980
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"118⤵PID:1412
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"119⤵PID:4400
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"120⤵PID:5036
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"121⤵PID:4592
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"122⤵PID:4636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-