fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd

Analysis

max time kernel
14s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/10/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Size 514KB
Sample261018-spvtmsfx51
SHA256 fd2649182b9f6e257500a86dc69fdd94a8fd80acb752d2f7779d199f7a3ababd
MD5 cb4367db67962f36b38ed5f2cc2c3235
SHA1 9f5574be9cbf6983ffeb1fec2b8ad72b87967674
SHA512 80ce8b6dde4a7676b014391698c9ca8f27dda1ce1b9cab483b2f1926996836fb9b995b967ccecadc3bcbd4086d90a683868049ce60907152cf6565fac9cc08cc
SSDEEP 12288:tsp8SE5ArAhq13jWaqsB5eol5auT04wy3ePPPz+JwXwh:Oi5q1pqsauY4srWV
TLSH
T117B42340B3D120F7E9961D320DF6E297D27A17F9F729505F2B044EFB38E62A641192CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\godhood.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\godhood.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\godhood.exe"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\godhood.exe"	msiexec.exe

Loads dropped DLL 12 IoCs

pid	Process
1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1752 set thread context of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 2696 set thread context of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 564 set thread context of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan.Win32.Nisloder.ui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2924	msiexec.exe
2924	msiexec.exe
1776	msiexec.exe
1776	msiexec.exe
948	msiexec.exe
948	msiexec.exe
3132	msiexec.exe
3132	msiexec.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2924	msiexec.exe
1776	msiexec.exe
948	msiexec.exe
3132	msiexec.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 2924	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	90
PID 1480 wrote to memory of 2924	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	90
PID 1480 wrote to memory of 2924	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	90
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 1480 wrote to memory of 5788	1480	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	89
PID 2924 wrote to memory of 1752	2924	msiexec.exe	91
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 1776	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	93
PID 1752 wrote to memory of 1776	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	93
PID 1752 wrote to memory of 1776	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	93
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1752 wrote to memory of 5916	1752	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	92
PID 1776 wrote to memory of 2696	1776	msiexec.exe	94
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 948	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	96
PID 2696 wrote to memory of 948	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	96
PID 2696 wrote to memory of 948	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	96
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 2696 wrote to memory of 1304	2696	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	95
PID 948 wrote to memory of 564	948	msiexec.exe	97
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 3132	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	99
PID 564 wrote to memory of 3132	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	99
PID 564 wrote to memory of 3132	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	99
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 564 wrote to memory of 5180	564	jaffacakes118_Trojan.Win32.Nisloder.ui.exe	98
PID 3132 wrote to memory of 5892	3132	msiexec.exe	100

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
  "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe"
  2⤵
  PID:5788
- C:\Windows\SysWOW64\msiexec.exe
  C:\Windows\SysWOW64\msiexec.exe
  2⤵
  - Modifies WinLogon for persistence
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
    C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
      C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
      4⤵
      PID:5916
  - - C:\Windows\SysWOW64\msiexec.exe
      C:\Windows\SysWOW64\msiexec.exe
      4⤵
      Modifies WinLogon for persistence
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        5⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        6⤵
        
        PID:1304
      - C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        6⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        7⤵
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        8⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        8⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        10⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        10⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        11⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        12⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        12⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        13⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        14⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        14⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        15⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        16⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        16⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        17⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        18⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        18⤵
        
        PID:1860
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        19⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        20⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        20⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        21⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        22⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        22⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        23⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        24⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        24⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        25⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        26⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        26⤵
        
        PID:820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        27⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        28⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        28⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        29⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        30⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        30⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        31⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        32⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        32⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        33⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        34⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        34⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        35⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        36⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        36⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        37⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        38⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        38⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        39⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        40⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        40⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        41⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        42⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        42⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        43⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        44⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        44⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        45⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        46⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        46⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        47⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        48⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        48⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        49⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        50⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        50⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        51⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        52⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        52⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        53⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        54⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        54⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        55⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        56⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        56⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        57⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        58⤵
        
        PID:2068
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        58⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        59⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        60⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        60⤵
        
        PID:936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        61⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        62⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        62⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        63⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        64⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        64⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        65⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        66⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        66⤵
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        67⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        68⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        68⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        69⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        70⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        70⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        71⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        72⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        72⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        73⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        74⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        74⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        75⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        76⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        76⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        77⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        78⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        78⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        79⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        80⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        80⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        81⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        82⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        82⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        83⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        84⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        84⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        85⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        86⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        86⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        87⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        88⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        88⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        89⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        90⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        90⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        91⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        92⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        92⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        93⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        94⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        94⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        95⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        96⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        96⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        97⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        98⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        98⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        99⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        100⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        100⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        101⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        102⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        102⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        103⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        104⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        104⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        105⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        106⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        106⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        107⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        108⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        108⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        109⤵
        
        PID:2672
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        110⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        110⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        111⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        112⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        112⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        113⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        114⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        114⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        115⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        116⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        116⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        117⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        118⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        118⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        119⤵
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        120⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        120⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        121⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        122⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        122⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        123⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        124⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        124⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        125⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        126⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        126⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        127⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        128⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        128⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        129⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        130⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        130⤵
        
        PID:2184
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        131⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        132⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        132⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        133⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        134⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\msiexec.exe
        
        C:\Windows\SysWOW64\msiexec.exe
        134⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        
        C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Nisloder.ui.exe
        135⤵
        
        PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StoaCognoscenti.bin

Path C:\Users\Admin\AppData\Local\Temp\StoaCognoscenti.bin
Size 424KB
SHA256 f032d791c8393c2a3929ef18875768f1d5b640ce9bbee0c3dd098a003c4cd140
MD5 056cc1e0de290b663c6bee1ca3e9daa2
SHA1 099c1eaeb4b2b1b854ea62b3282ddff132c715bd
SHA512 8d4cfb68372d59c08d33761768f0c9f18da18dadf31f8a186bc9e3c7e4b6c2b205fd80a42d2c8f216ddb4a21bbe7e52bbf646677a382bd4740729926a3c703ac
SSDEEP 12288:v8SE5ArAhq13jWaqsB5eol5auT04wy3ePPv:45q1pqsauY4sv
TLSH
T1B7943348A2A170B7326FBA150AD5E4C3A2250B9EEFB5107B16584DB729DE3BC113438F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

counterpunch.dll

Path C:\Users\Admin\AppData\Local\Temp\counterpunch.dll
Size 68KB
SHA256 9fa3cfd7236097bb87445e9401916037797a84fe56768cd3fa63dfb470950cf7
MD5 945b5b91aeda04c62a3dffad18eb1dc7
SHA1 aef842a008d05332ca5f8206077204645983f1cc
SHA512 9fa1ed5f550515e737eca5943d898d814e0c180299f0b64cdec170ccab9ca9c74cfcaca65faae7dcdfbcc9d0c4c172ff0bd6c65b84a70e19823ce7ff4192cb84
SSDEEP 768:xJzu7/F7xIyMgNZpDReu51Kl7+Dql0J9Z8aY4it8oP8+lu:H3PgNrFeYqWV8awt8oPFu
TLSH
T1D9634C113A9184FBD58E413804A7CB72163ABC4256F694533FD76AEF4E326A0F53B30A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst1852.tmp\System.dll
Size 11KB
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
TLSH
T1A8325C15136046F3E1D2853C542B3AAB6FB869118AF04E43CFB36852EF396C79D79352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/756-282-0x00000000022E0000-0x00000000022F2000-memory.dmp

Download

memory/1480-10-0x00000000022D0000-0x00000000022E2000-memory.dmp

Download

memory/1504-201-0x00000000021E0000-0x00000000021F2000-memory.dmp

Download

memory/1688-324-0x00000000023A0000-0x00000000023B2000-memory.dmp

Download

memory/2344-239-0x00000000022C0000-0x00000000022D2000-memory.dmp

Download

memory/2580-220-0x00000000023F0000-0x0000000002402000-memory.dmp

Download

memory/2624-268-0x00000000024E0000-0x00000000024F2000-memory.dmp

Download

memory/2696-49-0x0000000003040000-0x0000000003052000-memory.dmp

Download

memory/2756-352-0x0000000003150000-0x0000000003162000-memory.dmp

Download

memory/2924-14-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/2944-310-0x00000000021D0000-0x00000000021E2000-memory.dmp

Download

memory/3284-576-0x0000000002290000-0x00000000022A2000-memory.dmp

Download

memory/4188-464-0x00000000024D0000-0x00000000024E2000-memory.dmp

Download

memory/4348-926-0x0000000002180000-0x0000000002192000-memory.dmp

Download

memory/4420-380-0x00000000022A0000-0x00000000022B2000-memory.dmp

Download

memory/4868-632-0x0000000003050000-0x0000000003062000-memory.dmp

Download

memory/5320-182-0x00000000023E0000-0x00000000023F2000-memory.dmp

Download

memory/5408-163-0x0000000003140000-0x0000000003152000-memory.dmp

Download

memory/5616-254-0x00000000022F0000-0x0000000002302000-memory.dmp

Download

memory/5764-996-0x00000000021A0000-0x00000000021B2000-memory.dmp

Download

memory/5788-15-0x0000000000400000-0x000000000046F000-memory.dmp

Download

memory/5828-125-0x00000000021C0000-0x00000000021D2000-memory.dmp

Download

memory/5892-87-0x0000000002420000-0x0000000002432000-memory.dmp

Download

memory/6088-968-0x0000000002200000-0x0000000002212000-memory.dmp

Download