Analysis
- max time kernel
54s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 09:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe
- Size 44KB
- Sample261014-k7ftfasvbz
- SHA256 3f84422493829ba603e7af9b76b5654c5b0d5e35c4352a1e93105ddce0ef55ed
- MD5 e07198603adaf8598a98b707701df012
- SHA1 805258713dbb40e0e92ff581ce4de0a74413ddd0
- SHA512 f6935facf180e69277827e823ec6dcca3cad97413bb853bf1789a167f7ec9fc11d7e27af97bebefa5248d91719b55e7f684147b659a015b15e9ca26e0fdc0b08
- SSDEEP 384:9fgDk1oWFYGaisBvHO8D+b7pf785FZJ9TT5ga7V1x+6MP:IEaiAvHb+dQfXBTV5146W
- TLSH T13713B70AF1C832EFE40467F82D7233E5E7ABC9F18A1D50447BDA1F586D79A92CD1490A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad mds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\mds = "{F2A5CACE-0062-436C-9560-45B72AA6ECD3}" mds.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad mds.exe - Executes dropped EXE 64 IoCs
pid Process 3532 mds.exe 4488 msn.exe 1724 msn.exe 3772 msn.exe 4304 msn.exe 4772 msn.exe 3324 msn.exe 2432 msn.exe 4140 msn.exe 2680 msn.exe 808 msn.exe 3472 msn.exe 1388 msn.exe 4748 msn.exe 2816 msn.exe 4756 msn.exe 2528 msn.exe 2108 msn.exe 4944 msn.exe 3508 msn.exe 2212 msn.exe 4256 msn.exe 1032 msn.exe 4032 msn.exe 1016 msn.exe 2480 msn.exe 1056 msn.exe 2700 msn.exe 1616 msn.exe 3668 msn.exe 4876 msn.exe 3888 msn.exe 4960 msn.exe 1948 msn.exe 4804 msn.exe 4948 msn.exe 4404 msn.exe 960 msn.exe 204 msn.exe 3032 msn.exe 3584 msn.exe 2868 msn.exe 776 msn.exe 3392 msn.exe 4616 msn.exe 2900 msn.exe 3164 msn.exe 3972 msn.exe 4980 msn.exe 1576 msn.exe 720 msn.exe 3896 msn.exe 916 msn.exe 3884 msn.exe 4816 msn.exe 1160 msn.exe 3116 msn.exe 3500 msn.exe 4800 msn.exe 2228 msn.exe 5096 msn.exe 3452 msn.exe 2632 msn.exe 1236 msn.exe - Loads dropped DLL 5 IoCs
pid Process 4320 mds.exe 4768 IEXPLORE.EXE 4768 IEXPLORE.EXE 27076 Process not Found 27076 Process not Found - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mds.exe = "c:\\windows\\syswow64\\mds.exe" mds.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mds.exe = "c:\\windows\\syswow64\\mds.exe" mds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mds.exe = "c:\\windows\\syswow64\\mds.exe" mds.exe Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mds.exe = "c:\\windows\\syswow64\\mds.exe" mds.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe msn.exe File created \??\c:\windows\SysWOW64\msn.exe Process not Found File created \??\c:\windows\SysWOW64\msn.exe Process not Found - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname mds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain mds.exe - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msn.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main Process not Found Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd788000000000200000000001066000000010000200000006a3715e63f0fce9966a46e1b51bc93cd449c728afea944c1153071b2429b5e35000000000e80000000020000200000007e99d5c762a667e7e77e9309fbcf546bed0d769bf9b99fe87ba0c0cee1327fd650000000e0cdc85f0762c7f7b1de96d8cca27be621b8ca7bb163c92e022c4418958eff966fa0a5d2b48480a02949288248939e6025b955d03d0211f2e369605bb685672ebdac52d55c920f55a2584eec3bc5cf4f400000005e7f3d95e14838dd5efb3dcbfdfceb078547312ba075e7a56f4b42d83c88df96b5815821c451ecf195412e81fdc5346d8ee1057c2737671f40f8d5aa633fa7cc IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{A3BF45BE-C7AF-11F1-B7E7-E2EB83378A00} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" Process not Found Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 16fc18bd3942dd01 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}§ionHeight={ie:sectionHeight}&FORM=IENTSS" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AFAFCDCE-C7AF-11F1-B7E7-E2EB83378A00} = "0" Process not Found Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\User Preferences IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000053a5c49a9d82d8449ce7d7575a6bd78800000000020000000000106600000001000020000000c8a5e77a5f308499a7a253ba8e1fc16a664119af035503334726fba197ba45dc000000000e800000000200002000000024052a9bebb3f3ff1481912f0b3a530defc9459621cf0942e5b1c8af224639a510000000d62dbd84fec8e85727e078e3afa81a1640000000157bcf7bdfda8d31c9d4f32f015712783d278a9e3a0ef77a6f0d43cdc92e0270d10a3362312a967268690438918c67c88d876f21bab8074a59d69b20166716c5 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" Process not Found - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID mds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2A5CACE-0062-436C-9560-45B72AA6ECD3} mds.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2A5CACE-0062-436C-9560-45B72AA6ECD3}\InProcServer32\ = "msdors.dll" mds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F2A5CACE-0062-436C-9560-45B72AA6ECD3}\InProcServer32 mds.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node mds.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3212 IEXPLORE.EXE 26908 Process not Found - Suspicious use of SetWindowsHookEx 13 IoCs
pid Process 4320 mds.exe 3212 IEXPLORE.EXE 3212 IEXPLORE.EXE 4768 IEXPLORE.EXE 4768 IEXPLORE.EXE 4768 IEXPLORE.EXE 4768 IEXPLORE.EXE 26908 Process not Found 26908 Process not Found 27076 Process not Found 27076 Process not Found 27076 Process not Found 27076 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 3532 3172 jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe 84 PID 3532 wrote to memory of 4488 3532 mds.exe 85 PID 4488 wrote to memory of 1724 4488 msn.exe 86 PID 1724 wrote to memory of 3772 1724 msn.exe 87 PID 3772 wrote to memory of 4304 3772 msn.exe 88 PID 4304 wrote to memory of 4772 4304 msn.exe 89 PID 4772 wrote to memory of 3324 4772 msn.exe 90 PID 3324 wrote to memory of 2432 3324 msn.exe 91 PID 2432 wrote to memory of 4140 2432 msn.exe 92 PID 4140 wrote to memory of 2680 4140 msn.exe 93 PID 2680 wrote to memory of 808 2680 msn.exe 94 PID 808 wrote to memory of 3472 808 msn.exe 95 PID 3472 wrote to memory of 1388 3472 msn.exe 96 PID 1388 wrote to memory of 4748 1388 msn.exe 97 PID 4748 wrote to memory of 2816 4748 msn.exe 98 PID 2816 wrote to memory of 4756 2816 msn.exe 99 PID 4756 wrote to memory of 2528 4756 msn.exe 100 PID 2528 wrote to memory of 2108 2528 msn.exe 101 PID 2108 wrote to memory of 4944 2108 msn.exe 102 PID 4944 wrote to memory of 3508 4944 msn.exe 103 PID 3508 wrote to memory of 2212 3508 msn.exe 104 PID 2212 wrote to memory of 4256 2212 msn.exe 105 PID 4256 wrote to memory of 1032 4256 msn.exe 106 PID 1032 wrote to memory of 4032 1032 msn.exe 107 PID 4032 wrote to memory of 1016 4032 msn.exe 108 PID 1016 wrote to memory of 2480 1016 msn.exe 109 PID 2480 wrote to memory of 1056 2480 msn.exe 110 PID 1056 wrote to memory of 2700 1056 msn.exe 111 PID 2700 wrote to memory of 1616 2700 msn.exe 112 PID 1616 wrote to memory of 3668 1616 msn.exe 113 PID 3668 wrote to memory of 4876 3668 msn.exe 114 PID 4876 wrote to memory of 3888 4876 msn.exe 115 PID 3888 wrote to memory of 4960 3888 msn.exe 116 PID 4960 wrote to memory of 1948 4960 msn.exe 117 PID 1948 wrote to memory of 4804 1948 msn.exe 118 PID 4804 wrote to memory of 4948 4804 msn.exe 119 PID 4948 wrote to memory of 4404 4948 msn.exe 120 PID 4404 wrote to memory of 960 4404 msn.exe 121 PID 960 wrote to memory of 204 960 msn.exe 122 PID 204 wrote to memory of 3032 204 msn.exe 123 PID 3032 wrote to memory of 3584 3032 msn.exe 124 PID 3584 wrote to memory of 2868 3584 msn.exe 126 PID 2868 wrote to memory of 776 2868 msn.exe 127 PID 776 wrote to memory of 3392 776 msn.exe 128 PID 3392 wrote to memory of 4616 3392 msn.exe 129 PID 4616 wrote to memory of 2900 4616 msn.exe 130 PID 2900 wrote to memory of 3164 2900 msn.exe 131 PID 3164 wrote to memory of 3972 3164 msn.exe 132 PID 3972 wrote to memory of 4980 3972 msn.exe 133 PID 4980 wrote to memory of 1576 4980 msn.exe 134 PID 1576 wrote to memory of 720 1576 msn.exe 135 PID 720 wrote to memory of 3896 720 msn.exe 136 PID 3896 wrote to memory of 916 3896 msn.exe 137 PID 916 wrote to memory of 3884 916 msn.exe 138 PID 3884 wrote to memory of 4816 3884 msn.exe 139 PID 4816 wrote to memory of 1160 4816 msn.exe 140 PID 1160 wrote to memory of 3116 1160 msn.exe 141 PID 3116 wrote to memory of 3500 3116 msn.exe 142 PID 3500 wrote to memory of 4800 3500 msn.exe 143 PID 4800 wrote to memory of 2228 4800 msn.exe 144 PID 2228 wrote to memory of 5096 2228 msn.exe 145 PID 5096 wrote to memory of 3452 5096 msn.exe 146 PID 3452 wrote to memory of 2632 3452 msn.exe 147 PID 2632 wrote to memory of 1236 2632 msn.exe 148
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Mixus.gen.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\windows\SysWOW64\mds.exec:\windows\system32\mds.exe2⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Windows\SysWOW64\msn.exeC:\Windows\system32\msn.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe23⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe24⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe25⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe26⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe27⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe28⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe29⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe30⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe31⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe32⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe33⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe34⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe35⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe36⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe37⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe38⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe39⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:960 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe40⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:204 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe41⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe42⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe43⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe44⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe45⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe46⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe47⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe48⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe49⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe50⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe51⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe52⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe53⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe54⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe55⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe56⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe57⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe58⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe59⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe60⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe61⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe62⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe63⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe64⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe65⤵
- Executes dropped EXE
PID:1236 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe66⤵PID:540
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe67⤵PID:1292
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe68⤵PID:4576
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe69⤵PID:2744
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe70⤵PID:2588
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe71⤵PID:4376
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe72⤵PID:1832
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe73⤵PID:4976
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe74⤵PID:3708
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe75⤵PID:2400
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe76⤵PID:1736
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe77⤵PID:4532
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe78⤵PID:1536
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe79⤵PID:2104
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe80⤵PID:2820
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe81⤵PID:1368
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe82⤵PID:2372
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe83⤵PID:2184
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe84⤵PID:3416
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe85⤵PID:1220
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe86⤵PID:4420
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe87⤵PID:3932
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe88⤵PID:3556
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe89⤵PID:4372
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe90⤵
- Drops file in System32 directory
PID:4232 -
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe91⤵PID:4544
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe92⤵PID:600
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe93⤵PID:2832
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe94⤵PID:888
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe95⤵PID:2424
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe96⤵PID:3348
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe97⤵PID:4272
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe98⤵PID:3756
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe99⤵PID:4432
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe100⤵PID:1908
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe101⤵PID:4276
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe102⤵PID:2912
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe103⤵PID:4108
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe104⤵PID:4992
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe105⤵PID:4124
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe106⤵PID:3976
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe107⤵PID:5132
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe108⤵PID:5144
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe109⤵PID:5160
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe110⤵PID:5184
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe111⤵PID:5204
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe112⤵PID:5224
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe113⤵PID:5244
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe114⤵PID:5256
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe115⤵PID:5276
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe116⤵PID:5292
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe117⤵PID:5308
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe118⤵PID:5320
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe119⤵PID:5340
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe120⤵PID:5352
-
\??\c:\windows\SysWOW64\msn.exec:\windows\system32\msn.exe121⤵PID:5372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-