Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 21:54
Static task
static1
Behavioral task
behavioral1
Sample
cc11826dbdf74f55f83653005ee9b420N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
cc11826dbdf74f55f83653005ee9b420N.exe
Resource
win10v2004-20240802-en
General
-
Target
cc11826dbdf74f55f83653005ee9b420N.exe
-
Size
65KB
-
MD5
cc11826dbdf74f55f83653005ee9b420
-
SHA1
9185b0e9e30cecb89060944af6d94c1c286a2b4e
-
SHA256
91b1e9107a2dcabc18429525b2dfb9271f3f13af7bb725c57b6ccf84e69a235f
-
SHA512
b9b96fc55b18eaf3d78c993e131fb4af693d06372cab9952e086f6b19ee2e2563031dbcf38087f200498b79929ce18c0be4605e709524f0c1ff88741e1d52973
-
SSDEEP
1536:hJ+Jwa74/Wgz4cqiTvQTppRWjWuN20O1dkSWO4kyR:hJ+JwqYWgUcrvapIWuMl1GSWO+
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1472 mdmi386.exe 2548 mdmi386.exe 3388 mdmi386.exe 4472 mdmi386.exe 3676 mdmi386.exe 3076 mdmi386.exe 4736 mdmi386.exe 3128 mdmi386.exe 3208 mdmi386.exe 716 mdmi386.exe 2264 mdmi386.exe 228 mdmi386.exe 2708 mdmi386.exe 4672 mdmi386.exe 4924 mdmi386.exe 3916 mdmi386.exe 4948 mdmi386.exe 3416 mdmi386.exe 1980 mdmi386.exe 1160 mdmi386.exe 4492 mdmi386.exe 940 mdmi386.exe 2464 mdmi386.exe 5052 mdmi386.exe 3080 mdmi386.exe 4612 mdmi386.exe 2044 mdmi386.exe 1320 mdmi386.exe 3480 mdmi386.exe 880 mdmi386.exe 372 mdmi386.exe 3260 mdmi386.exe 548 mdmi386.exe 2356 mdmi386.exe 2024 mdmi386.exe 4396 mdmi386.exe 3500 mdmi386.exe 3344 mdmi386.exe 3316 mdmi386.exe 5036 mdmi386.exe 3964 mdmi386.exe 4508 mdmi386.exe 1920 mdmi386.exe 3140 mdmi386.exe 868 mdmi386.exe 5004 mdmi386.exe 2788 mdmi386.exe 4384 mdmi386.exe 556 mdmi386.exe 4620 mdmi386.exe 828 mdmi386.exe 4772 mdmi386.exe 1304 mdmi386.exe 3388 mdmi386.exe 3904 mdmi386.exe 540 mdmi386.exe 3796 mdmi386.exe 4736 mdmi386.exe 4116 mdmi386.exe 3128 mdmi386.exe 3684 mdmi386.exe 716 mdmi386.exe 2348 mdmi386.exe 2556 mdmi386.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe mdmi386.exe File created C:\Windows\SysWOW64\mdmi386.exe Process not Found File created C:\Windows\SysWOW64\mdmi386.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language mdmi386.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 1472 2488 cc11826dbdf74f55f83653005ee9b420N.exe 83 PID 2488 wrote to memory of 1472 2488 cc11826dbdf74f55f83653005ee9b420N.exe 83 PID 2488 wrote to memory of 1472 2488 cc11826dbdf74f55f83653005ee9b420N.exe 83 PID 1472 wrote to memory of 2548 1472 mdmi386.exe 84 PID 1472 wrote to memory of 2548 1472 mdmi386.exe 84 PID 1472 wrote to memory of 2548 1472 mdmi386.exe 84 PID 2548 wrote to memory of 3388 2548 mdmi386.exe 85 PID 2548 wrote to memory of 3388 2548 mdmi386.exe 85 PID 2548 wrote to memory of 3388 2548 mdmi386.exe 85 PID 3388 wrote to memory of 4472 3388 mdmi386.exe 86 PID 3388 wrote to memory of 4472 3388 mdmi386.exe 86 PID 3388 wrote to memory of 4472 3388 mdmi386.exe 86 PID 4472 wrote to memory of 3676 4472 mdmi386.exe 87 PID 4472 wrote to memory of 3676 4472 mdmi386.exe 87 PID 4472 wrote to memory of 3676 4472 mdmi386.exe 87 PID 3676 wrote to memory of 3076 3676 mdmi386.exe 88 PID 3676 wrote to memory of 3076 3676 mdmi386.exe 88 PID 3676 wrote to memory of 3076 3676 mdmi386.exe 88 PID 3076 wrote to memory of 4736 3076 mdmi386.exe 89 PID 3076 wrote to memory of 4736 3076 mdmi386.exe 89 PID 3076 wrote to memory of 4736 3076 mdmi386.exe 89 PID 4736 wrote to memory of 3128 4736 mdmi386.exe 90 PID 4736 wrote to memory of 3128 4736 mdmi386.exe 90 PID 4736 wrote to memory of 3128 4736 mdmi386.exe 90 PID 3128 wrote to memory of 3208 3128 mdmi386.exe 91 PID 3128 wrote to memory of 3208 3128 mdmi386.exe 91 PID 3128 wrote to memory of 3208 3128 mdmi386.exe 91 PID 3208 wrote to memory of 716 3208 mdmi386.exe 92 PID 3208 wrote to memory of 716 3208 mdmi386.exe 92 PID 3208 wrote to memory of 716 3208 mdmi386.exe 92 PID 716 wrote to memory of 2264 716 mdmi386.exe 93 PID 716 wrote to memory of 2264 716 mdmi386.exe 93 PID 716 wrote to memory of 2264 716 mdmi386.exe 93 PID 2264 wrote to memory of 228 2264 mdmi386.exe 94 PID 2264 wrote to memory of 228 2264 mdmi386.exe 94 PID 2264 wrote to memory of 228 2264 mdmi386.exe 94 PID 228 wrote to memory of 2708 228 mdmi386.exe 95 PID 228 wrote to memory of 2708 228 mdmi386.exe 95 PID 228 wrote to memory of 2708 228 mdmi386.exe 95 PID 2708 wrote to memory of 4672 2708 mdmi386.exe 96 PID 2708 wrote to memory of 4672 2708 mdmi386.exe 96 PID 2708 wrote to memory of 4672 2708 mdmi386.exe 96 PID 4672 wrote to memory of 4924 4672 mdmi386.exe 98 PID 4672 wrote to memory of 4924 4672 mdmi386.exe 98 PID 4672 wrote to memory of 4924 4672 mdmi386.exe 98 PID 4924 wrote to memory of 3916 4924 mdmi386.exe 99 PID 4924 wrote to memory of 3916 4924 mdmi386.exe 99 PID 4924 wrote to memory of 3916 4924 mdmi386.exe 99 PID 3916 wrote to memory of 4948 3916 mdmi386.exe 100 PID 3916 wrote to memory of 4948 3916 mdmi386.exe 100 PID 3916 wrote to memory of 4948 3916 mdmi386.exe 100 PID 4948 wrote to memory of 3416 4948 mdmi386.exe 101 PID 4948 wrote to memory of 3416 4948 mdmi386.exe 101 PID 4948 wrote to memory of 3416 4948 mdmi386.exe 101 PID 3416 wrote to memory of 1980 3416 mdmi386.exe 102 PID 3416 wrote to memory of 1980 3416 mdmi386.exe 102 PID 3416 wrote to memory of 1980 3416 mdmi386.exe 102 PID 1980 wrote to memory of 1160 1980 mdmi386.exe 104 PID 1980 wrote to memory of 1160 1980 mdmi386.exe 104 PID 1980 wrote to memory of 1160 1980 mdmi386.exe 104 PID 1160 wrote to memory of 4492 1160 mdmi386.exe 105 PID 1160 wrote to memory of 4492 1160 mdmi386.exe 105 PID 1160 wrote to memory of 4492 1160 mdmi386.exe 105 PID 4492 wrote to memory of 940 4492 mdmi386.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc11826dbdf74f55f83653005ee9b420N.exe"C:\Users\Admin\AppData\Local\Temp\cc11826dbdf74f55f83653005ee9b420N.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"23⤵
- Executes dropped EXE
PID:940 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"24⤵
- Executes dropped EXE
PID:2464 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"25⤵
- Executes dropped EXE
PID:5052 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"26⤵
- Executes dropped EXE
PID:3080 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"27⤵
- Executes dropped EXE
PID:4612 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"28⤵
- Executes dropped EXE
PID:2044 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"29⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"30⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3480 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"31⤵
- Executes dropped EXE
PID:880 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"32⤵
- Executes dropped EXE
PID:372 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"33⤵
- Executes dropped EXE
PID:3260 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"34⤵
- Executes dropped EXE
PID:548 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"35⤵
- Executes dropped EXE
PID:2356 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2024 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"37⤵
- Executes dropped EXE
PID:4396 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"38⤵
- Executes dropped EXE
PID:3500 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"39⤵
- Executes dropped EXE
PID:3344 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"40⤵
- Executes dropped EXE
PID:3316 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"41⤵
- Executes dropped EXE
PID:5036 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"42⤵
- Executes dropped EXE
PID:3964 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"43⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"44⤵
- Executes dropped EXE
PID:1920 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"45⤵
- Executes dropped EXE
PID:3140 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"46⤵
- Executes dropped EXE
PID:868 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"47⤵
- Executes dropped EXE
PID:5004 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"48⤵
- Executes dropped EXE
PID:2788 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"49⤵
- Executes dropped EXE
PID:4384 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"50⤵
- Executes dropped EXE
PID:556 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"51⤵
- Executes dropped EXE
PID:4620 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"52⤵
- Executes dropped EXE
PID:828 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"53⤵
- Executes dropped EXE
PID:4772 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"54⤵
- Executes dropped EXE
PID:1304 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"55⤵
- Executes dropped EXE
PID:3388 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"56⤵
- Executes dropped EXE
PID:3904 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"57⤵
- Executes dropped EXE
PID:540 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"58⤵
- Executes dropped EXE
PID:3796 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"59⤵
- Executes dropped EXE
PID:4736 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"60⤵
- Executes dropped EXE
PID:4116 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"61⤵
- Executes dropped EXE
PID:3128 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"62⤵
- Executes dropped EXE
PID:3684 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"63⤵
- Executes dropped EXE
PID:716 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"64⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"65⤵
- Executes dropped EXE
PID:2556 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"66⤵PID:4596
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"67⤵PID:2680
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"68⤵PID:2728
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"69⤵PID:1468
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"70⤵PID:4332
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"71⤵PID:4524
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"72⤵PID:5104
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"73⤵PID:2332
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"74⤵PID:3448
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"75⤵PID:2776
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"76⤵PID:4492
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"77⤵PID:3912
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"78⤵PID:4832
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"79⤵PID:4016
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"80⤵PID:2476
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"81⤵PID:3080
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"82⤵PID:3520
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"83⤵PID:4084
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"84⤵PID:1064
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"85⤵PID:1892
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"86⤵PID:932
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"87⤵PID:3508
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"88⤵PID:748
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"89⤵
- Drops file in System32 directory
PID:3264 -
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"90⤵PID:3260
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"91⤵PID:3632
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"92⤵PID:5088
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"93⤵PID:4336
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"94⤵PID:4396
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"95⤵PID:1528
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"96⤵PID:2248
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"97⤵PID:3752
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"98⤵PID:704
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"99⤵PID:3740
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"100⤵PID:2480
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"101⤵PID:2908
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"102⤵PID:2320
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"103⤵PID:3140
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"104⤵PID:868
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"105⤵PID:4600
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"106⤵PID:3712
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"107⤵PID:3820
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"108⤵PID:4928
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"109⤵PID:4092
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"110⤵PID:1472
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"111⤵PID:3600
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"112⤵PID:4244
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"113⤵PID:1304
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"114⤵PID:3388
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"115⤵PID:4976
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"116⤵PID:3488
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"117⤵PID:1868
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"118⤵PID:2924
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"119⤵PID:612
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"120⤵PID:4116
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"121⤵PID:1480
-
C:\Windows\SysWOW64\mdmi386.exe"mdmi386.exe"122⤵PID:2832
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-