Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 10:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe
-
Size
536KB
-
MD5
110cff4bcf78ebf56277863e605bce84
-
SHA1
4755695d8c8e206416431b1794c2c9277a4e1b59
-
SHA256
cc54126bb06e8ebb923686591c387cd3adf622fefdce7b8f79e9abf3532768d8
-
SHA512
b667f6903ac6d0d0a7b1585a4db7296a7b72b382f44cdac9bbdbe087796f23906a0f0a09d66f5167460ac8c54c9bf604dd3a2a7d7616b2663fdc2841c8ccdcf4
-
SSDEEP
12288:wU5rCOTeiUNapHL/6RN0855tAzTBpHeCinIZxVJ0ZT9:wUQOJUNapHj6RpraX+vIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2692 C2E2.tmp 2176 C34F.tmp 2376 C3EB.tmp 2172 C477.tmp 2240 C504.tmp 2924 C5A0.tmp 2764 C63C.tmp 2776 C6D8.tmp 2344 C745.tmp 2608 C7C2.tmp 1624 C84E.tmp 2584 C8DB.tmp 1988 C957.tmp 2428 C9A5.tmp 340 CA41.tmp 2052 CAAF.tmp 684 CB5A.tmp 1736 CBE7.tmp 2976 CCB1.tmp 2220 CD2E.tmp 1460 CDDA.tmp 3040 CE66.tmp 604 CED3.tmp 1076 CF31.tmp 824 CF8F.tmp 1572 CFFC.tmp 892 D059.tmp 1748 D0B7.tmp 3048 D124.tmp 2256 D182.tmp 2552 D1EF.tmp 1724 D26C.tmp 2496 D2C9.tmp 1620 D308.tmp 2368 D365.tmp 1692 D3A4.tmp 2156 D401.tmp 1428 D440.tmp 2560 D47E.tmp 2332 D4CC.tmp 2084 D50B.tmp 2172 D559.tmp 2856 D5A7.tmp 3024 D5F5.tmp 2860 D643.tmp 2788 D691.tmp 2816 D6CF.tmp 2660 D70D.tmp 2644 D75B.tmp 2736 D79A.tmp 2020 D7E8.tmp 1624 D836.tmp 896 D874.tmp 1656 D8B3.tmp 1836 D901.tmp 1788 D93F.tmp 1608 D97D.tmp 2052 D9BC.tmp 2904 D9FA.tmp 2892 DA39.tmp 3004 DA77.tmp 2196 DAB5.tmp 764 DAF4.tmp 1128 DB32.tmp -
Loads dropped DLL 64 IoCs
pid Process 1312 2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe 2692 C2E2.tmp 2176 C34F.tmp 2376 C3EB.tmp 2172 C477.tmp 2240 C504.tmp 2924 C5A0.tmp 2764 C63C.tmp 2776 C6D8.tmp 2344 C745.tmp 2608 C7C2.tmp 1624 C84E.tmp 2584 C8DB.tmp 1988 C957.tmp 2428 C9A5.tmp 340 CA41.tmp 2052 CAAF.tmp 684 CB5A.tmp 1736 CBE7.tmp 2976 CCB1.tmp 2220 CD2E.tmp 1460 CDDA.tmp 3040 CE66.tmp 604 CED3.tmp 1076 CF31.tmp 824 CF8F.tmp 1572 CFFC.tmp 892 D059.tmp 1748 D0B7.tmp 3048 D124.tmp 2256 D182.tmp 2552 D1EF.tmp 1724 D26C.tmp 2496 D2C9.tmp 1620 D308.tmp 2368 D365.tmp 1692 D3A4.tmp 2156 D401.tmp 1428 D440.tmp 2560 D47E.tmp 2332 D4CC.tmp 2084 D50B.tmp 2172 D559.tmp 2856 D5A7.tmp 3024 D5F5.tmp 2860 D643.tmp 2788 D691.tmp 2816 D6CF.tmp 2660 D70D.tmp 2644 D75B.tmp 2736 D79A.tmp 2020 D7E8.tmp 1624 D836.tmp 896 D874.tmp 1656 D8B3.tmp 1836 D901.tmp 1788 D93F.tmp 1608 D97D.tmp 2052 D9BC.tmp 2904 D9FA.tmp 2892 DA39.tmp 3004 DA77.tmp 2196 DAB5.tmp 764 DAF4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 31DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8028.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E10C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 367B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4357.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9379.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2932.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC04.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1312 wrote to memory of 2692 1312 2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe 30 PID 1312 wrote to memory of 2692 1312 2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe 30 PID 1312 wrote to memory of 2692 1312 2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe 30 PID 1312 wrote to memory of 2692 1312 2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe 30 PID 2692 wrote to memory of 2176 2692 C2E2.tmp 31 PID 2692 wrote to memory of 2176 2692 C2E2.tmp 31 PID 2692 wrote to memory of 2176 2692 C2E2.tmp 31 PID 2692 wrote to memory of 2176 2692 C2E2.tmp 31 PID 2176 wrote to memory of 2376 2176 C34F.tmp 32 PID 2176 wrote to memory of 2376 2176 C34F.tmp 32 PID 2176 wrote to memory of 2376 2176 C34F.tmp 32 PID 2176 wrote to memory of 2376 2176 C34F.tmp 32 PID 2376 wrote to memory of 2172 2376 C3EB.tmp 33 PID 2376 wrote to memory of 2172 2376 C3EB.tmp 33 PID 2376 wrote to memory of 2172 2376 C3EB.tmp 33 PID 2376 wrote to memory of 2172 2376 C3EB.tmp 33 PID 2172 wrote to memory of 2240 2172 C477.tmp 34 PID 2172 wrote to memory of 2240 2172 C477.tmp 34 PID 2172 wrote to memory of 2240 2172 C477.tmp 34 PID 2172 wrote to memory of 2240 2172 C477.tmp 34 PID 2240 wrote to memory of 2924 2240 C504.tmp 35 PID 2240 wrote to memory of 2924 2240 C504.tmp 35 PID 2240 wrote to memory of 2924 2240 C504.tmp 35 PID 2240 wrote to memory of 2924 2240 C504.tmp 35 PID 2924 wrote to memory of 2764 2924 C5A0.tmp 36 PID 2924 wrote to memory of 2764 2924 C5A0.tmp 36 PID 2924 wrote to memory of 2764 2924 C5A0.tmp 36 PID 2924 wrote to memory of 2764 2924 C5A0.tmp 36 PID 2764 wrote to memory of 2776 2764 C63C.tmp 37 PID 2764 wrote to memory of 2776 2764 C63C.tmp 37 PID 2764 wrote to memory of 2776 2764 C63C.tmp 37 PID 2764 wrote to memory of 2776 2764 C63C.tmp 37 PID 2776 wrote to memory of 2344 2776 C6D8.tmp 38 PID 2776 wrote to memory of 2344 2776 C6D8.tmp 38 PID 2776 wrote to memory of 2344 2776 C6D8.tmp 38 PID 2776 wrote to memory of 2344 2776 C6D8.tmp 38 PID 2344 wrote to memory of 2608 2344 C745.tmp 39 PID 2344 wrote to memory of 2608 2344 C745.tmp 39 PID 2344 wrote to memory of 2608 2344 C745.tmp 39 PID 2344 wrote to memory of 2608 2344 C745.tmp 39 PID 2608 wrote to memory of 1624 2608 C7C2.tmp 40 PID 2608 wrote to memory of 1624 2608 C7C2.tmp 40 PID 2608 wrote to memory of 1624 2608 C7C2.tmp 40 PID 2608 wrote to memory of 1624 2608 C7C2.tmp 40 PID 1624 wrote to memory of 2584 1624 C84E.tmp 41 PID 1624 wrote to memory of 2584 1624 C84E.tmp 41 PID 1624 wrote to memory of 2584 1624 C84E.tmp 41 PID 1624 wrote to memory of 2584 1624 C84E.tmp 41 PID 2584 wrote to memory of 1988 2584 C8DB.tmp 42 PID 2584 wrote to memory of 1988 2584 C8DB.tmp 42 PID 2584 wrote to memory of 1988 2584 C8DB.tmp 42 PID 2584 wrote to memory of 1988 2584 C8DB.tmp 42 PID 1988 wrote to memory of 2428 1988 C957.tmp 43 PID 1988 wrote to memory of 2428 1988 C957.tmp 43 PID 1988 wrote to memory of 2428 1988 C957.tmp 43 PID 1988 wrote to memory of 2428 1988 C957.tmp 43 PID 2428 wrote to memory of 340 2428 C9A5.tmp 44 PID 2428 wrote to memory of 340 2428 C9A5.tmp 44 PID 2428 wrote to memory of 340 2428 C9A5.tmp 44 PID 2428 wrote to memory of 340 2428 C9A5.tmp 44 PID 340 wrote to memory of 2052 340 CA41.tmp 45 PID 340 wrote to memory of 2052 340 CA41.tmp 45 PID 340 wrote to memory of 2052 340 CA41.tmp 45 PID 340 wrote to memory of 2052 340 CA41.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_110cff4bcf78ebf56277863e605bce84_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\C84E.tmp"C:\Users\Admin\AppData\Local\Temp\C84E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\D365.tmp"C:\Users\Admin\AppData\Local\Temp\D365.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"C:\Users\Admin\AppData\Local\Temp\D3A4.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\D50B.tmp"C:\Users\Admin\AppData\Local\Temp\D50B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\D559.tmp"C:\Users\Admin\AppData\Local\Temp\D559.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\D836.tmp"C:\Users\Admin\AppData\Local\Temp\D836.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\D874.tmp"C:\Users\Admin\AppData\Local\Temp\D874.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"65⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"66⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"67⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"68⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"69⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"70⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"71⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"72⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"73⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"74⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"75⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"76⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"77⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"78⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"79⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"80⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"81⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"82⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"83⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E051.tmp"C:\Users\Admin\AppData\Local\Temp\E051.tmp"84⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E08F.tmp"C:\Users\Admin\AppData\Local\Temp\E08F.tmp"85⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"86⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"88⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"89⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"90⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"91⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"92⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"93⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"C:\Users\Admin\AppData\Local\Temp\E2E0.tmp"94⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"95⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"96⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"97⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"98⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"100⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"101⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\E512.tmp"C:\Users\Admin\AppData\Local\Temp\E512.tmp"102⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"103⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"104⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"105⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"106⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"107⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"108⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"109⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"110⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"111⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"C:\Users\Admin\AppData\Local\Temp\E7A1.tmp"112⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"C:\Users\Admin\AppData\Local\Temp\E7DF.tmp"113⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"114⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"115⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"116⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"117⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"118⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"119⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"120⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"121⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"122⤵PID:748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-