Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe
-
Size
536KB
-
MD5
f216000eb44c9a99802c2745770adb6d
-
SHA1
5988df4493f6806bf62582dbf66875adb1e186ac
-
SHA256
12da66432c9e9fdcec3b43fb7dab5e0e6887b1d51fe2ec299c12abc15ad9d38f
-
SHA512
7724e0284c962eb35c073daa5ca70be4916dc06725d32d84e8de1793988bf6bc7c89bd3043f386319f938ec44c8685eec18eb7cff1d52040bfcc64a23711ca3d
-
SSDEEP
12288:wU5rCOTeiUbmhz4slSaTvtfY1PCb4IZxVJ0ZT9:wUQOJU6h5SkvtfY1P44IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2364 D04A.tmp 1632 D0E6.tmp 1080 D1A1.tmp 2244 D23D.tmp 2840 D28B.tmp 2760 D365.tmp 2660 D401.tmp 2852 D47E.tmp 2628 D4EB.tmp 2748 D578.tmp 1900 D5B6.tmp 1120 D5F5.tmp 3016 D652.tmp 2904 D691.tmp 2008 D6DF.tmp 1896 D71D.tmp 3024 D75B.tmp 2180 D79A.tmp 2480 D7D8.tmp 2536 D817.tmp 2432 D855.tmp 2140 D893.tmp 1684 D8D2.tmp 1276 D910.tmp 3028 D94F.tmp 1964 D98D.tmp 2096 D9CB.tmp 1456 DA0A.tmp 2476 DA58.tmp 692 DA96.tmp 1592 DAD5.tmp 1308 DB13.tmp 2716 DB51.tmp 1284 DBBF.tmp 760 DBFD.tmp 2328 DC7A.tmp 2404 DCB8.tmp 2560 DD06.tmp 576 DD54.tmp 2192 DDB2.tmp 2248 DE00.tmp 1376 DE3E.tmp 2756 DE8C.tmp 2780 DECB.tmp 2840 DF19.tmp 2980 DF57.tmp 2648 DF96.tmp 2876 DFD4.tmp 320 E012.tmp 2628 E051.tmp 2656 E08F.tmp 2668 E0BE.tmp 2816 E0FC.tmp 3016 E12B.tmp 2904 E16A.tmp 3032 E198.tmp 2992 E1D7.tmp 1436 E206.tmp 2688 E244.tmp 3020 E282.tmp 1176 E2C1.tmp 1756 E30F.tmp 3052 E34D.tmp 2412 E37C.tmp -
Loads dropped DLL 64 IoCs
pid Process 2136 2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe 2364 D04A.tmp 1632 D0E6.tmp 1080 D1A1.tmp 2244 D23D.tmp 2840 D28B.tmp 2760 D365.tmp 2660 D401.tmp 2852 D47E.tmp 2628 D4EB.tmp 2748 D578.tmp 1900 D5B6.tmp 1120 D5F5.tmp 3016 D652.tmp 2904 D691.tmp 2008 D6DF.tmp 1896 D71D.tmp 3024 D75B.tmp 2180 D79A.tmp 2480 D7D8.tmp 2536 D817.tmp 2432 D855.tmp 2140 D893.tmp 1684 D8D2.tmp 1276 D910.tmp 3028 D94F.tmp 1964 D98D.tmp 2096 D9CB.tmp 1456 DA0A.tmp 2476 DA58.tmp 692 DA96.tmp 1592 DAD5.tmp 1308 DB13.tmp 2716 DB51.tmp 1284 DBBF.tmp 760 DBFD.tmp 2328 DC7A.tmp 2404 DCB8.tmp 2560 DD06.tmp 576 DD54.tmp 2192 DDB2.tmp 2248 DE00.tmp 1376 DE3E.tmp 2756 DE8C.tmp 2780 DECB.tmp 2840 DF19.tmp 2980 DF57.tmp 2648 DF96.tmp 2876 DFD4.tmp 320 E012.tmp 2628 E051.tmp 2656 E08F.tmp 2668 E0BE.tmp 2816 E0FC.tmp 3016 E12B.tmp 2904 E16A.tmp 3032 E198.tmp 2992 E1D7.tmp 1436 E206.tmp 2688 E244.tmp 3020 E282.tmp 1176 E2C1.tmp 1756 E30F.tmp 3052 E34D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6420.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 256B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5457.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 196A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9637.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F660.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F058.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2364 2136 2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe 30 PID 2136 wrote to memory of 2364 2136 2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe 30 PID 2136 wrote to memory of 2364 2136 2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe 30 PID 2136 wrote to memory of 2364 2136 2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe 30 PID 2364 wrote to memory of 1632 2364 D04A.tmp 31 PID 2364 wrote to memory of 1632 2364 D04A.tmp 31 PID 2364 wrote to memory of 1632 2364 D04A.tmp 31 PID 2364 wrote to memory of 1632 2364 D04A.tmp 31 PID 1632 wrote to memory of 1080 1632 D0E6.tmp 293 PID 1632 wrote to memory of 1080 1632 D0E6.tmp 293 PID 1632 wrote to memory of 1080 1632 D0E6.tmp 293 PID 1632 wrote to memory of 1080 1632 D0E6.tmp 293 PID 1080 wrote to memory of 2244 1080 D1A1.tmp 113 PID 1080 wrote to memory of 2244 1080 D1A1.tmp 113 PID 1080 wrote to memory of 2244 1080 D1A1.tmp 113 PID 1080 wrote to memory of 2244 1080 D1A1.tmp 113 PID 2244 wrote to memory of 2840 2244 D23D.tmp 75 PID 2244 wrote to memory of 2840 2244 D23D.tmp 75 PID 2244 wrote to memory of 2840 2244 D23D.tmp 75 PID 2244 wrote to memory of 2840 2244 D23D.tmp 75 PID 2840 wrote to memory of 2760 2840 D28B.tmp 35 PID 2840 wrote to memory of 2760 2840 D28B.tmp 35 PID 2840 wrote to memory of 2760 2840 D28B.tmp 35 PID 2840 wrote to memory of 2760 2840 D28B.tmp 35 PID 2760 wrote to memory of 2660 2760 D365.tmp 36 PID 2760 wrote to memory of 2660 2760 D365.tmp 36 PID 2760 wrote to memory of 2660 2760 D365.tmp 36 PID 2760 wrote to memory of 2660 2760 D365.tmp 36 PID 2660 wrote to memory of 2852 2660 D401.tmp 303 PID 2660 wrote to memory of 2852 2660 D401.tmp 303 PID 2660 wrote to memory of 2852 2660 D401.tmp 303 PID 2660 wrote to memory of 2852 2660 D401.tmp 303 PID 2852 wrote to memory of 2628 2852 D47E.tmp 38 PID 2852 wrote to memory of 2628 2852 D47E.tmp 38 PID 2852 wrote to memory of 2628 2852 D47E.tmp 38 PID 2852 wrote to memory of 2628 2852 D47E.tmp 38 PID 2628 wrote to memory of 2748 2628 D4EB.tmp 39 PID 2628 wrote to memory of 2748 2628 D4EB.tmp 39 PID 2628 wrote to memory of 2748 2628 D4EB.tmp 39 PID 2628 wrote to memory of 2748 2628 D4EB.tmp 39 PID 2748 wrote to memory of 1900 2748 D578.tmp 40 PID 2748 wrote to memory of 1900 2748 D578.tmp 40 PID 2748 wrote to memory of 1900 2748 D578.tmp 40 PID 2748 wrote to memory of 1900 2748 D578.tmp 40 PID 1900 wrote to memory of 1120 1900 D5B6.tmp 41 PID 1900 wrote to memory of 1120 1900 D5B6.tmp 41 PID 1900 wrote to memory of 1120 1900 D5B6.tmp 41 PID 1900 wrote to memory of 1120 1900 D5B6.tmp 41 PID 1120 wrote to memory of 3016 1120 D5F5.tmp 42 PID 1120 wrote to memory of 3016 1120 D5F5.tmp 42 PID 1120 wrote to memory of 3016 1120 D5F5.tmp 42 PID 1120 wrote to memory of 3016 1120 D5F5.tmp 42 PID 3016 wrote to memory of 2904 3016 D652.tmp 43 PID 3016 wrote to memory of 2904 3016 D652.tmp 43 PID 3016 wrote to memory of 2904 3016 D652.tmp 43 PID 3016 wrote to memory of 2904 3016 D652.tmp 43 PID 2904 wrote to memory of 2008 2904 D691.tmp 45 PID 2904 wrote to memory of 2008 2904 D691.tmp 45 PID 2904 wrote to memory of 2008 2904 D691.tmp 45 PID 2904 wrote to memory of 2008 2904 D691.tmp 45 PID 2008 wrote to memory of 1896 2008 D6DF.tmp 46 PID 2008 wrote to memory of 1896 2008 D6DF.tmp 46 PID 2008 wrote to memory of 1896 2008 D6DF.tmp 46 PID 2008 wrote to memory of 1896 2008 D6DF.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_f216000eb44c9a99802c2745770adb6d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\D910.tmp"C:\Users\Admin\AppData\Local\Temp\D910.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\D94F.tmp"C:\Users\Admin\AppData\Local\Temp\D94F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"C:\Users\Admin\AppData\Local\Temp\DA0A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"C:\Users\Admin\AppData\Local\Temp\DAD5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\DF19.tmp"C:\Users\Admin\AppData\Local\Temp\DF19.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\E051.tmp"C:\Users\Admin\AppData\Local\Temp\E051.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\E08F.tmp"C:\Users\Admin\AppData\Local\Temp\E08F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E12B.tmp"C:\Users\Admin\AppData\Local\Temp\E12B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\E16A.tmp"C:\Users\Admin\AppData\Local\Temp\E16A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"C:\Users\Admin\AppData\Local\Temp\E2C1.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"65⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"66⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"67⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"68⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"69⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\E495.tmp"C:\Users\Admin\AppData\Local\Temp\E495.tmp"70⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"72⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"73⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"74⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"75⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:580 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"77⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"78⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"79⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"80⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"81⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"82⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"83⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"84⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"85⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"86⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"C:\Users\Admin\AppData\Local\Temp\E8AA.tmp"87⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"88⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"89⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"90⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"91⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"92⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"93⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"94⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"95⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"96⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"97⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"98⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"99⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"100⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"101⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"102⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"103⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\EC71.tmp"C:\Users\Admin\AppData\Local\Temp\EC71.tmp"104⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"105⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"106⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"107⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"108⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"109⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"110⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"112⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\EE64.tmp"C:\Users\Admin\AppData\Local\Temp\EE64.tmp"113⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"114⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"115⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"116⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"117⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"118⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"119⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"C:\Users\Admin\AppData\Local\Temp\EFDB.tmp"120⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"121⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\F058.tmp"C:\Users\Admin\AppData\Local\Temp\F058.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:2388
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-