Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe
-
Size
74KB
-
MD5
45c76c1717fe39f6eada9ad5e08eca8b
-
SHA1
dc414caff1bb1b5d15b73e3c32d13a323322fd13
-
SHA256
062bed039cb8d49df104f180a07b13dc5274852d4e5e885159a92008edad7250
-
SHA512
9ca314168aae42205065bbfdc94e589ba0bbb4932c94fb7e4820a7d3f579b275466dd85c83f109614d5b10d6cff42b44f2d7edbd29fa7bf1f52ddfa564bd1834
-
SSDEEP
1536:8mmg2PcY3CfPsraJvnmnt2USxzF7wsSXokv1h/WalxZrT3hmz/ES:8mmTPsfPsraJ+n05xzuYU1Ialn5mzES
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 952 msapi.exe 1988 msapi.exe 2844 msapi.exe 2876 msapi.exe 4688 msapi.exe 412 msapi.exe 716 msapi.exe 2560 msapi.exe 4900 msapi.exe 4144 msapi.exe 3496 msapi.exe 4564 msapi.exe 1148 msapi.exe 4088 msapi.exe 4816 msapi.exe 1856 msapi.exe 4440 msapi.exe 3472 msapi.exe 2148 msapi.exe 2404 msapi.exe 4172 msapi.exe 1528 msapi.exe 4284 msapi.exe 392 msapi.exe 4844 msapi.exe 4320 msapi.exe 3460 msapi.exe 1976 msapi.exe 468 msapi.exe 2112 msapi.exe 1744 msapi.exe 2196 msapi.exe 936 msapi.exe 1004 msapi.exe 4840 msapi.exe 1100 msapi.exe 3560 msapi.exe 1192 msapi.exe 1060 msapi.exe 3068 msapi.exe 4448 msapi.exe 4944 msapi.exe 2648 msapi.exe 1036 msapi.exe 1288 msapi.exe 3404 msapi.exe 2916 msapi.exe 4304 msapi.exe 4380 msapi.exe 5064 msapi.exe 4068 msapi.exe 1132 msapi.exe 656 msapi.exe 3264 msapi.exe 384 msapi.exe 4832 msapi.exe 2340 msapi.exe 4988 msapi.exe 3292 msapi.exe 2676 msapi.exe 2348 msapi.exe 2328 msapi.exe 1188 msapi.exe 3876 msapi.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe msapi.exe File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File opened for modification C:\Windows\SysWOW64\msapi.dll msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe msapi.exe File created C:\Windows\SysWOW64\msapi.exe Process not Found File created C:\Windows\SysWOW64\msapi.exe Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\msapi.dll Process not Found File opened for modification C:\Windows\SysWOW64\snet.exe Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msapi.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 388 wrote to memory of 952 388 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 86 PID 388 wrote to memory of 952 388 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 86 PID 388 wrote to memory of 952 388 45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe 86 PID 952 wrote to memory of 1988 952 msapi.exe 87 PID 952 wrote to memory of 1988 952 msapi.exe 87 PID 952 wrote to memory of 1988 952 msapi.exe 87 PID 1988 wrote to memory of 2844 1988 msapi.exe 88 PID 1988 wrote to memory of 2844 1988 msapi.exe 88 PID 1988 wrote to memory of 2844 1988 msapi.exe 88 PID 2844 wrote to memory of 2876 2844 msapi.exe 89 PID 2844 wrote to memory of 2876 2844 msapi.exe 89 PID 2844 wrote to memory of 2876 2844 msapi.exe 89 PID 2876 wrote to memory of 4688 2876 msapi.exe 90 PID 2876 wrote to memory of 4688 2876 msapi.exe 90 PID 2876 wrote to memory of 4688 2876 msapi.exe 90 PID 4688 wrote to memory of 412 4688 msapi.exe 91 PID 4688 wrote to memory of 412 4688 msapi.exe 91 PID 4688 wrote to memory of 412 4688 msapi.exe 91 PID 412 wrote to memory of 716 412 msapi.exe 92 PID 412 wrote to memory of 716 412 msapi.exe 92 PID 412 wrote to memory of 716 412 msapi.exe 92 PID 716 wrote to memory of 2560 716 msapi.exe 93 PID 716 wrote to memory of 2560 716 msapi.exe 93 PID 716 wrote to memory of 2560 716 msapi.exe 93 PID 2560 wrote to memory of 4900 2560 msapi.exe 94 PID 2560 wrote to memory of 4900 2560 msapi.exe 94 PID 2560 wrote to memory of 4900 2560 msapi.exe 94 PID 4900 wrote to memory of 4144 4900 msapi.exe 95 PID 4900 wrote to memory of 4144 4900 msapi.exe 95 PID 4900 wrote to memory of 4144 4900 msapi.exe 95 PID 4144 wrote to memory of 3496 4144 msapi.exe 96 PID 4144 wrote to memory of 3496 4144 msapi.exe 96 PID 4144 wrote to memory of 3496 4144 msapi.exe 96 PID 3496 wrote to memory of 4564 3496 msapi.exe 97 PID 3496 wrote to memory of 4564 3496 msapi.exe 97 PID 3496 wrote to memory of 4564 3496 msapi.exe 97 PID 4564 wrote to memory of 1148 4564 msapi.exe 98 PID 4564 wrote to memory of 1148 4564 msapi.exe 98 PID 4564 wrote to memory of 1148 4564 msapi.exe 98 PID 1148 wrote to memory of 4088 1148 msapi.exe 99 PID 1148 wrote to memory of 4088 1148 msapi.exe 99 PID 1148 wrote to memory of 4088 1148 msapi.exe 99 PID 4088 wrote to memory of 4816 4088 msapi.exe 100 PID 4088 wrote to memory of 4816 4088 msapi.exe 100 PID 4088 wrote to memory of 4816 4088 msapi.exe 100 PID 4816 wrote to memory of 1856 4816 msapi.exe 101 PID 4816 wrote to memory of 1856 4816 msapi.exe 101 PID 4816 wrote to memory of 1856 4816 msapi.exe 101 PID 1856 wrote to memory of 4440 1856 msapi.exe 102 PID 1856 wrote to memory of 4440 1856 msapi.exe 102 PID 1856 wrote to memory of 4440 1856 msapi.exe 102 PID 4440 wrote to memory of 3472 4440 msapi.exe 103 PID 4440 wrote to memory of 3472 4440 msapi.exe 103 PID 4440 wrote to memory of 3472 4440 msapi.exe 103 PID 3472 wrote to memory of 2148 3472 msapi.exe 104 PID 3472 wrote to memory of 2148 3472 msapi.exe 104 PID 3472 wrote to memory of 2148 3472 msapi.exe 104 PID 2148 wrote to memory of 2404 2148 msapi.exe 105 PID 2148 wrote to memory of 2404 2148 msapi.exe 105 PID 2148 wrote to memory of 2404 2148 msapi.exe 105 PID 2404 wrote to memory of 4172 2404 msapi.exe 106 PID 2404 wrote to memory of 4172 2404 msapi.exe 106 PID 2404 wrote to memory of 4172 2404 msapi.exe 106 PID 4172 wrote to memory of 1528 4172 msapi.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45c76c1717fe39f6eada9ad5e08eca8b_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe23⤵
- Executes dropped EXE
PID:1528 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe24⤵
- Executes dropped EXE
PID:4284 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe25⤵
- Executes dropped EXE
PID:392 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe26⤵
- Executes dropped EXE
PID:4844 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe27⤵
- Executes dropped EXE
PID:4320 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe28⤵
- Executes dropped EXE
PID:3460 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe29⤵
- Executes dropped EXE
PID:1976 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe30⤵
- Executes dropped EXE
PID:468 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe31⤵
- Executes dropped EXE
PID:2112 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe32⤵
- Executes dropped EXE
PID:1744 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe33⤵
- Executes dropped EXE
PID:2196 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe34⤵
- Executes dropped EXE
PID:936 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe35⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe36⤵
- Executes dropped EXE
PID:4840 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe37⤵
- Executes dropped EXE
PID:1100 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe38⤵
- Executes dropped EXE
PID:3560 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe39⤵
- Executes dropped EXE
PID:1192 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe40⤵
- Executes dropped EXE
PID:1060 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe41⤵
- Executes dropped EXE
PID:3068 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe42⤵
- Executes dropped EXE
PID:4448 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe43⤵
- Executes dropped EXE
PID:4944 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe44⤵
- Executes dropped EXE
PID:2648 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe45⤵
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe46⤵
- Executes dropped EXE
PID:1288 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe47⤵
- Executes dropped EXE
PID:3404 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe48⤵
- Executes dropped EXE
PID:2916 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe49⤵
- Executes dropped EXE
PID:4304 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe50⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:4380 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe51⤵
- Executes dropped EXE
PID:5064 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe52⤵
- Executes dropped EXE
PID:4068 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe53⤵
- Executes dropped EXE
PID:1132 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe54⤵
- Executes dropped EXE
PID:656 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe55⤵
- Executes dropped EXE
PID:3264 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe56⤵
- Executes dropped EXE
PID:384 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe57⤵
- Executes dropped EXE
PID:4832 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe58⤵
- Executes dropped EXE
PID:2340 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe59⤵
- Executes dropped EXE
PID:4988 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe60⤵
- Executes dropped EXE
PID:3292 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe61⤵
- Executes dropped EXE
PID:2676 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe62⤵
- Executes dropped EXE
PID:2348 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe63⤵
- Executes dropped EXE
PID:2328 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe64⤵
- Executes dropped EXE
PID:1188 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe65⤵
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe66⤵PID:1496
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe67⤵PID:1152
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe68⤵PID:3604
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe69⤵PID:3552
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe70⤵PID:1572
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe71⤵PID:1468
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe72⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe73⤵PID:1500
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe74⤵PID:1616
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe75⤵PID:4860
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe76⤵PID:3464
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe77⤵PID:3628
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe78⤵PID:2292
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe79⤵PID:4404
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe80⤵PID:4084
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe81⤵PID:1916
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe82⤵PID:2704
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe83⤵PID:1264
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe84⤵PID:4048
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe85⤵PID:4948
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe86⤵PID:4288
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe87⤵PID:3392
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe88⤵PID:1140
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe89⤵PID:4280
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe90⤵PID:740
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe91⤵PID:1748
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe92⤵PID:3000
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe93⤵PID:5136
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe94⤵PID:5160
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe95⤵PID:5188
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe96⤵PID:5208
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe97⤵PID:5244
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe98⤵PID:5268
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe99⤵PID:5292
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe100⤵PID:5320
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe101⤵PID:5344
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe102⤵PID:5368
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe103⤵PID:5420
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe104⤵
- System Location Discovery: System Language Discovery
PID:5460 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe105⤵PID:5480
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe106⤵PID:5504
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe107⤵PID:5528
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe108⤵PID:5552
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe109⤵PID:5576
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe110⤵PID:5600
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe111⤵PID:5624
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe112⤵PID:5644
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe113⤵PID:5672
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe114⤵PID:5700
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe115⤵
- System Location Discovery: System Language Discovery
PID:5724 -
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe116⤵PID:5748
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe117⤵PID:5772
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe118⤵PID:5796
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe119⤵PID:5820
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe120⤵PID:5844
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe121⤵PID:5868
-
C:\Windows\SysWOW64\msapi.exeC:\Windows\system32\msapi.exe122⤵PID:5892
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-