Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 06:40
Static task
static1
Behavioral task
behavioral1
Sample
d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe
-
Size
65KB
-
MD5
d14dfb8f410d26e5bc97924b85fcd75a
-
SHA1
e80ea0ca2fa700ae7247d5b7f5ceaa0dd54821c6
-
SHA256
3b6d0a9b35acff3700a13a5dcede039112ab07f165366217aeb82be9d3cb19ab
-
SHA512
e1e3b40972e1394fe7f6ed04e4b7657f78f78dba68124268493a39d19cf99894e606790b526aad5d7366a79a523197d56bc20fc6da80942febb1a86d2aaf9e0f
-
SSDEEP
1536:br1lpvB0CVz20s881t/DjebgCuP3axE31X469SQSIJ9:Vlpv5i5bjNCuvLFt9SBIJ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4436 mdmi386.exe 2044 mdmi386.exe 1220 mdmi386.exe 4512 mdmi386.exe 4112 mdmi386.exe 684 mdmi386.exe 1972 mdmi386.exe 2908 mdmi386.exe 2992 mdmi386.exe 1948 mdmi386.exe 5060 mdmi386.exe 4196 mdmi386.exe 5016 mdmi386.exe 4840 mdmi386.exe 1356 mdmi386.exe 808 mdmi386.exe 3732 mdmi386.exe 4164 mdmi386.exe 624 mdmi386.exe 2204 mdmi386.exe 4588 mdmi386.exe 4420 mdmi386.exe 4996 mdmi386.exe 3320 mdmi386.exe 3324 mdmi386.exe 464 mdmi386.exe 756 mdmi386.exe 1532 mdmi386.exe 668 mdmi386.exe 552 mdmi386.exe 3888 mdmi386.exe 64 mdmi386.exe 976 mdmi386.exe 4468 mdmi386.exe 3516 mdmi386.exe 4180 mdmi386.exe 2724 mdmi386.exe 740 mdmi386.exe 748 mdmi386.exe 4580 mdmi386.exe 220 mdmi386.exe 2016 mdmi386.exe 3944 mdmi386.exe 3460 mdmi386.exe 5052 mdmi386.exe 1352 mdmi386.exe 1892 mdmi386.exe 3248 mdmi386.exe 4356 mdmi386.exe 4372 mdmi386.exe 1056 mdmi386.exe 2504 mdmi386.exe 1336 mdmi386.exe 1568 mdmi386.exe 932 mdmi386.exe 3820 mdmi386.exe 2392 mdmi386.exe 3748 mdmi386.exe 2372 mdmi386.exe 1004 mdmi386.exe 1660 mdmi386.exe 2076 mdmi386.exe 3160 mdmi386.exe 3776 mdmi386.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 4436 4200 d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe 82 PID 4200 wrote to memory of 4436 4200 d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe 82 PID 4200 wrote to memory of 4436 4200 d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe 82 PID 4436 wrote to memory of 2044 4436 mdmi386.exe 83 PID 4436 wrote to memory of 2044 4436 mdmi386.exe 83 PID 4436 wrote to memory of 2044 4436 mdmi386.exe 83 PID 2044 wrote to memory of 1220 2044 mdmi386.exe 84 PID 2044 wrote to memory of 1220 2044 mdmi386.exe 84 PID 2044 wrote to memory of 1220 2044 mdmi386.exe 84 PID 1220 wrote to memory of 4512 1220 mdmi386.exe 85 PID 1220 wrote to memory of 4512 1220 mdmi386.exe 85 PID 1220 wrote to memory of 4512 1220 mdmi386.exe 85 PID 4512 wrote to memory of 4112 4512 mdmi386.exe 86 PID 4512 wrote to memory of 4112 4512 mdmi386.exe 86 PID 4512 wrote to memory of 4112 4512 mdmi386.exe 86 PID 4112 wrote to memory of 684 4112 mdmi386.exe 87 PID 4112 wrote to memory of 684 4112 mdmi386.exe 87 PID 4112 wrote to memory of 684 4112 mdmi386.exe 87 PID 684 wrote to memory of 1972 684 mdmi386.exe 89 PID 684 wrote to memory of 1972 684 mdmi386.exe 89 PID 684 wrote to memory of 1972 684 mdmi386.exe 89 PID 1972 wrote to memory of 2908 1972 mdmi386.exe 90 PID 1972 wrote to memory of 2908 1972 mdmi386.exe 90 PID 1972 wrote to memory of 2908 1972 mdmi386.exe 90 PID 2908 wrote to memory of 2992 2908 mdmi386.exe 91 PID 2908 wrote to memory of 2992 2908 mdmi386.exe 91 PID 2908 wrote to memory of 2992 2908 mdmi386.exe 91 PID 2992 wrote to memory of 1948 2992 mdmi386.exe 92 PID 2992 wrote to memory of 1948 2992 mdmi386.exe 92 PID 2992 wrote to memory of 1948 2992 mdmi386.exe 92 PID 1948 wrote to memory of 5060 1948 mdmi386.exe 94 PID 1948 wrote to memory of 5060 1948 mdmi386.exe 94 PID 1948 wrote to memory of 5060 1948 mdmi386.exe 94 PID 5060 wrote to memory of 4196 5060 mdmi386.exe 95 PID 5060 wrote to memory of 4196 5060 mdmi386.exe 95 PID 5060 wrote to memory of 4196 5060 mdmi386.exe 95 PID 4196 wrote to memory of 5016 4196 mdmi386.exe 96 PID 4196 wrote to memory of 5016 4196 mdmi386.exe 96 PID 4196 wrote to memory of 5016 4196 mdmi386.exe 96 PID 5016 wrote to memory of 4840 5016 mdmi386.exe 97 PID 5016 wrote to memory of 4840 5016 mdmi386.exe 97 PID 5016 wrote to memory of 4840 5016 mdmi386.exe 97 PID 4840 wrote to memory of 1356 4840 mdmi386.exe 98 PID 4840 wrote to memory of 1356 4840 mdmi386.exe 98 PID 4840 wrote to memory of 1356 4840 mdmi386.exe 98 PID 1356 wrote to memory of 808 1356 mdmi386.exe 156 PID 1356 wrote to memory of 808 1356 mdmi386.exe 156 PID 1356 wrote to memory of 808 1356 mdmi386.exe 156 PID 808 wrote to memory of 3732 808 mdmi386.exe 100 PID 808 wrote to memory of 3732 808 mdmi386.exe 100 PID 808 wrote to memory of 3732 808 mdmi386.exe 100 PID 3732 wrote to memory of 4164 3732 mdmi386.exe 159 PID 3732 wrote to memory of 4164 3732 mdmi386.exe 159 PID 3732 wrote to memory of 4164 3732 mdmi386.exe 159 PID 4164 wrote to memory of 624 4164 mdmi386.exe 102 PID 4164 wrote to memory of 624 4164 mdmi386.exe 102 PID 4164 wrote to memory of 624 4164 mdmi386.exe 102 PID 624 wrote to memory of 2204 624 mdmi386.exe 103 PID 624 wrote to memory of 2204 624 mdmi386.exe 103 PID 624 wrote to memory of 2204 624 mdmi386.exe 103 PID 2204 wrote to memory of 4588 2204 mdmi386.exe 161 PID 2204 wrote to memory of 4588 2204 mdmi386.exe 161 PID 2204 wrote to memory of 4588 2204 mdmi386.exe 161 PID 4588 wrote to memory of 4420 4588 mdmi386.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d14dfb8f410d26e5bc97924b85fcd75a_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"23⤵
- Executes dropped EXE
PID:4420 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"24⤵
- Executes dropped EXE
PID:4996 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"25⤵
- Executes dropped EXE
PID:3320 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"26⤵
- Executes dropped EXE
PID:3324 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"27⤵
- Executes dropped EXE
PID:464 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"28⤵
- Executes dropped EXE
PID:756 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"29⤵
- Executes dropped EXE
PID:1532 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:668 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"31⤵
- Executes dropped EXE
PID:552 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"32⤵
- Executes dropped EXE
PID:3888 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"33⤵
- Executes dropped EXE
PID:64 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"34⤵
- Executes dropped EXE
PID:976 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"35⤵
- Executes dropped EXE
PID:4468 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"36⤵
- Executes dropped EXE
PID:3516 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"37⤵
- Executes dropped EXE
PID:4180 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"38⤵
- Executes dropped EXE
PID:2724 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"39⤵
- Executes dropped EXE
PID:740 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"40⤵
- Executes dropped EXE
PID:748 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"41⤵
- Executes dropped EXE
PID:4580 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"42⤵
- Executes dropped EXE
PID:220 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"43⤵
- Executes dropped EXE
PID:2016 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"44⤵
- Executes dropped EXE
PID:3944 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"45⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"46⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"47⤵
- Executes dropped EXE
PID:1352 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"48⤵
- Executes dropped EXE
PID:1892 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"49⤵
- Executes dropped EXE
PID:3248 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"50⤵
- Executes dropped EXE
PID:4356 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"51⤵
- Executes dropped EXE
PID:4372 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"52⤵
- Executes dropped EXE
PID:1056 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"53⤵
- Executes dropped EXE
PID:2504 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"54⤵
- Executes dropped EXE
PID:1336 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"55⤵
- Executes dropped EXE
PID:1568 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"56⤵
- Executes dropped EXE
PID:932 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"57⤵
- Executes dropped EXE
PID:3820 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"58⤵
- Executes dropped EXE
PID:2392 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"59⤵
- Executes dropped EXE
PID:3748 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"60⤵
- Executes dropped EXE
PID:2372 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"61⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"62⤵
- Executes dropped EXE
PID:1660 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"63⤵
- Executes dropped EXE
PID:2076 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"64⤵
- Executes dropped EXE
PID:3160 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"65⤵
- Executes dropped EXE
PID:3776 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"66⤵PID:3980
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"67⤵PID:212
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"68⤵PID:4428
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"69⤵PID:4756
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"70⤵PID:4456
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"71⤵PID:1764
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"72⤵PID:4392
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"73⤵PID:808
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"74⤵PID:2592
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"75⤵PID:4784
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"76⤵PID:4164
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"77⤵PID:4176
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"78⤵PID:4588
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"79⤵PID:3300
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"80⤵PID:548
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"81⤵PID:1000
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"82⤵PID:4572
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"83⤵PID:3188
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"84⤵PID:4280
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"85⤵PID:4988
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"86⤵PID:2652
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"87⤵PID:4284
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"88⤵PID:3264
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"89⤵PID:2288
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"90⤵PID:2280
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"91⤵PID:2496
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"92⤵PID:976
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"93⤵PID:4468
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"94⤵PID:2936
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"95⤵PID:3096
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"96⤵PID:1188
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"97⤵PID:2464
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"98⤵PID:4568
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"99⤵PID:1664
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"100⤵PID:5020
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"101⤵PID:5028
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"102⤵PID:3008
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"103⤵PID:4852
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"104⤵PID:2016
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"105⤵PID:3700
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"106⤵PID:4816
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"107⤵PID:3020
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"108⤵PID:1516
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"109⤵PID:3164
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"110⤵PID:4360
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"111⤵PID:680
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"112⤵PID:4372
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"113⤵PID:1488
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"114⤵PID:4868
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"115⤵PID:860
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"116⤵PID:4424
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"117⤵PID:1936
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"118⤵PID:3820
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"119⤵PID:692
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"120⤵PID:3748
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"121⤵PID:4088
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"122⤵PID:1436
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-