Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe
-
Size
712KB
-
MD5
db4af3559ebcd81e4c319d1afa3f3f0e
-
SHA1
d2f158d6e9a7332729c7cbeb85ed42898e70db27
-
SHA256
f1cca4cb2072bf72eb0b7e917c69dff54097ba3a4d072e836bbf0a161eea1910
-
SHA512
41782bfa1e49738d16a9ce554452710300151259d9c311dad43b8decda1e480884c5671ec1a9c66041064c374e907cc5cc4f3a19182605083a48f98ad9da5e73
-
SSDEEP
12288:FU5rCOTeiDyjmd1GLpIvYcY3I/X72wfYr9IhoNZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDh1GL+vYcD/X724IEoNnCvq5TJH
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 316 4B04.tmp 2632 4B91.tmp 2732 4C0E.tmp 2636 4C8A.tmp 2620 4CF8.tmp 2532 4D65.tmp 2552 4DC2.tmp 2508 4E20.tmp 2624 4E7E.tmp 2072 4EEB.tmp 2908 4F48.tmp 748 4F96.tmp 448 4FF4.tmp 1744 5071.tmp 2980 50BF.tmp 2868 50FD.tmp 2856 518A.tmp 2136 51D8.tmp 2848 5245.tmp 2844 52B2.tmp 2184 537D.tmp 2748 53BB.tmp 1144 5428.tmp 320 5476.tmp 2340 54B5.tmp 2124 54F3.tmp 2128 5532.tmp 2060 5570.tmp 2156 55AE.tmp 296 55ED.tmp 2472 562B.tmp 836 566A.tmp 1264 56A8.tmp 2396 56D7.tmp 892 5715.tmp 1904 5754.tmp 1976 5792.tmp 1844 57F0.tmp 1648 585D.tmp 1276 58AB.tmp 1064 5928.tmp 2884 5985.tmp 2828 59E3.tmp 2960 5A21.tmp 2272 5A60.tmp 484 5A9E.tmp 2404 5ADD.tmp 2696 5B1B.tmp 1688 5B59.tmp 2252 5B98.tmp 3068 5BD6.tmp 1592 5C15.tmp 1972 5C53.tmp 2608 5C91.tmp 2240 5CD0.tmp 2716 5D1E.tmp 2708 5D5C.tmp 2784 5D9B.tmp 2176 5DE9.tmp 2808 5E27.tmp 2620 5E65.tmp 2652 5EA4.tmp 2520 5EE2.tmp 2692 5F21.tmp -
Loads dropped DLL 64 IoCs
pid Process 2596 2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe 316 4B04.tmp 2632 4B91.tmp 2732 4C0E.tmp 2636 4C8A.tmp 2620 4CF8.tmp 2532 4D65.tmp 2552 4DC2.tmp 2508 4E20.tmp 2624 4E7E.tmp 2072 4EEB.tmp 2908 4F48.tmp 748 4F96.tmp 448 4FF4.tmp 1744 5071.tmp 2980 50BF.tmp 2868 50FD.tmp 2856 518A.tmp 2136 51D8.tmp 2848 5245.tmp 2844 52B2.tmp 2184 537D.tmp 2748 53BB.tmp 1144 5428.tmp 320 5476.tmp 2340 54B5.tmp 2124 54F3.tmp 2128 5532.tmp 2060 5570.tmp 2156 55AE.tmp 296 55ED.tmp 2472 562B.tmp 836 566A.tmp 1264 56A8.tmp 2396 56D7.tmp 892 5715.tmp 1904 5754.tmp 1976 5792.tmp 1844 57F0.tmp 1648 585D.tmp 1276 58AB.tmp 1064 5928.tmp 2884 5985.tmp 2828 59E3.tmp 2960 5A21.tmp 2272 5A60.tmp 484 5A9E.tmp 2404 5ADD.tmp 2696 5B1B.tmp 1688 5B59.tmp 2252 5B98.tmp 3068 5BD6.tmp 1592 5C15.tmp 1972 5C53.tmp 2608 5C91.tmp 2240 5CD0.tmp 2716 5D1E.tmp 2708 5D5C.tmp 2784 5D9B.tmp 2176 5DE9.tmp 2808 5E27.tmp 2620 5E65.tmp 2652 5EA4.tmp 2520 5EE2.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D088.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1342.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C764.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 55ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3285.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 206C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2359.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9231.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2596 wrote to memory of 316 2596 2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe 30 PID 2596 wrote to memory of 316 2596 2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe 30 PID 2596 wrote to memory of 316 2596 2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe 30 PID 2596 wrote to memory of 316 2596 2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe 30 PID 316 wrote to memory of 2632 316 4B04.tmp 31 PID 316 wrote to memory of 2632 316 4B04.tmp 31 PID 316 wrote to memory of 2632 316 4B04.tmp 31 PID 316 wrote to memory of 2632 316 4B04.tmp 31 PID 2632 wrote to memory of 2732 2632 4B91.tmp 32 PID 2632 wrote to memory of 2732 2632 4B91.tmp 32 PID 2632 wrote to memory of 2732 2632 4B91.tmp 32 PID 2632 wrote to memory of 2732 2632 4B91.tmp 32 PID 2732 wrote to memory of 2636 2732 4C0E.tmp 33 PID 2732 wrote to memory of 2636 2732 4C0E.tmp 33 PID 2732 wrote to memory of 2636 2732 4C0E.tmp 33 PID 2732 wrote to memory of 2636 2732 4C0E.tmp 33 PID 2636 wrote to memory of 2620 2636 4C8A.tmp 34 PID 2636 wrote to memory of 2620 2636 4C8A.tmp 34 PID 2636 wrote to memory of 2620 2636 4C8A.tmp 34 PID 2636 wrote to memory of 2620 2636 4C8A.tmp 34 PID 2620 wrote to memory of 2532 2620 4CF8.tmp 35 PID 2620 wrote to memory of 2532 2620 4CF8.tmp 35 PID 2620 wrote to memory of 2532 2620 4CF8.tmp 35 PID 2620 wrote to memory of 2532 2620 4CF8.tmp 35 PID 2532 wrote to memory of 2552 2532 4D65.tmp 36 PID 2532 wrote to memory of 2552 2532 4D65.tmp 36 PID 2532 wrote to memory of 2552 2532 4D65.tmp 36 PID 2532 wrote to memory of 2552 2532 4D65.tmp 36 PID 2552 wrote to memory of 2508 2552 4DC2.tmp 37 PID 2552 wrote to memory of 2508 2552 4DC2.tmp 37 PID 2552 wrote to memory of 2508 2552 4DC2.tmp 37 PID 2552 wrote to memory of 2508 2552 4DC2.tmp 37 PID 2508 wrote to memory of 2624 2508 4E20.tmp 38 PID 2508 wrote to memory of 2624 2508 4E20.tmp 38 PID 2508 wrote to memory of 2624 2508 4E20.tmp 38 PID 2508 wrote to memory of 2624 2508 4E20.tmp 38 PID 2624 wrote to memory of 2072 2624 4E7E.tmp 39 PID 2624 wrote to memory of 2072 2624 4E7E.tmp 39 PID 2624 wrote to memory of 2072 2624 4E7E.tmp 39 PID 2624 wrote to memory of 2072 2624 4E7E.tmp 39 PID 2072 wrote to memory of 2908 2072 4EEB.tmp 40 PID 2072 wrote to memory of 2908 2072 4EEB.tmp 40 PID 2072 wrote to memory of 2908 2072 4EEB.tmp 40 PID 2072 wrote to memory of 2908 2072 4EEB.tmp 40 PID 2908 wrote to memory of 748 2908 4F48.tmp 41 PID 2908 wrote to memory of 748 2908 4F48.tmp 41 PID 2908 wrote to memory of 748 2908 4F48.tmp 41 PID 2908 wrote to memory of 748 2908 4F48.tmp 41 PID 748 wrote to memory of 448 748 4F96.tmp 42 PID 748 wrote to memory of 448 748 4F96.tmp 42 PID 748 wrote to memory of 448 748 4F96.tmp 42 PID 748 wrote to memory of 448 748 4F96.tmp 42 PID 448 wrote to memory of 1744 448 4FF4.tmp 43 PID 448 wrote to memory of 1744 448 4FF4.tmp 43 PID 448 wrote to memory of 1744 448 4FF4.tmp 43 PID 448 wrote to memory of 1744 448 4FF4.tmp 43 PID 1744 wrote to memory of 2980 1744 5071.tmp 44 PID 1744 wrote to memory of 2980 1744 5071.tmp 44 PID 1744 wrote to memory of 2980 1744 5071.tmp 44 PID 1744 wrote to memory of 2980 1744 5071.tmp 44 PID 2980 wrote to memory of 2868 2980 50BF.tmp 45 PID 2980 wrote to memory of 2868 2980 50BF.tmp 45 PID 2980 wrote to memory of 2868 2980 50BF.tmp 45 PID 2980 wrote to memory of 2868 2980 50BF.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_db4af3559ebcd81e4c319d1afa3f3f0e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\4B91.tmp"C:\Users\Admin\AppData\Local\Temp\4B91.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"C:\Users\Admin\AppData\Local\Temp\4CF8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\4F48.tmp"C:\Users\Admin\AppData\Local\Temp\4F48.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\4F96.tmp"C:\Users\Admin\AppData\Local\Temp\4F96.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"C:\Users\Admin\AppData\Local\Temp\4FF4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\50BF.tmp"C:\Users\Admin\AppData\Local\Temp\50BF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\51D8.tmp"C:\Users\Admin\AppData\Local\Temp\51D8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\537D.tmp"C:\Users\Admin\AppData\Local\Temp\537D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:296 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\56D7.tmp"C:\Users\Admin\AppData\Local\Temp\56D7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\5754.tmp"C:\Users\Admin\AppData\Local\Temp\5754.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\5792.tmp"C:\Users\Admin\AppData\Local\Temp\5792.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\585D.tmp"C:\Users\Admin\AppData\Local\Temp\585D.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5985.tmp"C:\Users\Admin\AppData\Local\Temp\5985.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"C:\Users\Admin\AppData\Local\Temp\5D5C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5DE9.tmp"C:\Users\Admin\AppData\Local\Temp\5DE9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\5E65.tmp"C:\Users\Admin\AppData\Local\Temp\5E65.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5F21.tmp"C:\Users\Admin\AppData\Local\Temp\5F21.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"66⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"C:\Users\Admin\AppData\Local\Temp\5F9D.tmp"67⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"68⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\601A.tmp"C:\Users\Admin\AppData\Local\Temp\601A.tmp"69⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\6059.tmp"C:\Users\Admin\AppData\Local\Temp\6059.tmp"70⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\6097.tmp"C:\Users\Admin\AppData\Local\Temp\6097.tmp"71⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"72⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"73⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\6152.tmp"C:\Users\Admin\AppData\Local\Temp\6152.tmp"74⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\6191.tmp"C:\Users\Admin\AppData\Local\Temp\6191.tmp"75⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\61CF.tmp"C:\Users\Admin\AppData\Local\Temp\61CF.tmp"76⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"77⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\624C.tmp"C:\Users\Admin\AppData\Local\Temp\624C.tmp"78⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\628A.tmp"C:\Users\Admin\AppData\Local\Temp\628A.tmp"79⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\62C9.tmp"C:\Users\Admin\AppData\Local\Temp\62C9.tmp"80⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\6307.tmp"C:\Users\Admin\AppData\Local\Temp\6307.tmp"81⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"82⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"83⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"84⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"85⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"86⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"87⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"89⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6539.tmp"C:\Users\Admin\AppData\Local\Temp\6539.tmp"90⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6577.tmp"C:\Users\Admin\AppData\Local\Temp\6577.tmp"91⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"92⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\65F4.tmp"C:\Users\Admin\AppData\Local\Temp\65F4.tmp"93⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6632.tmp"C:\Users\Admin\AppData\Local\Temp\6632.tmp"94⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\6671.tmp"C:\Users\Admin\AppData\Local\Temp\6671.tmp"95⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"96⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\66ED.tmp"C:\Users\Admin\AppData\Local\Temp\66ED.tmp"97⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"98⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"99⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"100⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"101⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"102⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"103⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"104⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"105⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"106⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"107⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"108⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"109⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"110⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"111⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"112⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"113⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"114⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"115⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"116⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"117⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"C:\Users\Admin\AppData\Local\Temp\6C5A.tmp"119⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\6C98.tmp"C:\Users\Admin\AppData\Local\Temp\6C98.tmp"120⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"121⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\6D15.tmp"C:\Users\Admin\AppData\Local\Temp\6D15.tmp"122⤵PID:2984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-