Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 04:02
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe
-
Size
527KB
-
MD5
721edb16d1774ae3ddb8296d72194c24
-
SHA1
292a1274d48c42cd6d1d1bd01fadd0b27ae063f0
-
SHA256
9e4a0071166974710b69126ab345e605d1c238fa71b4459cd4e32e0635c861f8
-
SHA512
4a8f9d1ab13fb12d151d0d1f21b695c4b5d0ebfd2714c377d45d05b0fe19bd416997f209300afa15be2b34e49196f2b6b7ba7a8307a229734cecb813535f5644
-
SSDEEP
12288:fU5rCOTeidcjXqOWCjdQ4JC8k3RnZwrPMSXBDZu:fUQOJdczrWMdkF3JZePMGBDo
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2304 CBA8.tmp 2300 CC25.tmp 576 CC83.tmp 2272 CCC1.tmp 2828 CCFF.tmp 2760 CD3E.tmp 2928 CD7C.tmp 2924 CDBB.tmp 1692 CDF9.tmp 2896 CE37.tmp 2764 CE85.tmp 2676 CEC4.tmp 1888 CF02.tmp 1792 CF50.tmp 1476 CF8F.tmp 3012 CFCD.tmp 2856 D00B.tmp 2860 D04A.tmp 2028 D088.tmp 3024 D0D6.tmp 1980 D115.tmp 528 D163.tmp 2056 D1A1.tmp 2332 D1EF.tmp 2084 D23D.tmp 1832 D27B.tmp 2352 D2BA.tmp 1568 D308.tmp 1900 D346.tmp 2628 D385.tmp 484 D3D3.tmp 2044 D421.tmp 1984 D45F.tmp 692 D49D.tmp 1028 D4DC.tmp 1852 D52A.tmp 1892 D587.tmp 972 D604.tmp 1720 D681.tmp 1464 D6FE.tmp 1668 D74C.tmp 1752 D79A.tmp 2576 D817.tmp 560 D855.tmp 888 D8B3.tmp 2436 D8F1.tmp 2552 D93F.tmp 1876 D97D.tmp 2432 D9BC.tmp 2496 D9FA.tmp 2276 DAC5.tmp 2244 DB13.tmp 1572 DB51.tmp 3068 DB90.tmp 2308 DBCE.tmp 1236 DC0D.tmp 804 DC5B.tmp 2768 DCA9.tmp 2672 DCE7.tmp 2664 DD35.tmp 2696 DD73.tmp 2948 DDC2.tmp 2840 DE00.tmp 2968 DE4E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1672 2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe 2304 CBA8.tmp 2300 CC25.tmp 576 CC83.tmp 2272 CCC1.tmp 2828 CCFF.tmp 2760 CD3E.tmp 2928 CD7C.tmp 2924 CDBB.tmp 1692 CDF9.tmp 2896 CE37.tmp 2764 CE85.tmp 2676 CEC4.tmp 1888 CF02.tmp 1792 CF50.tmp 1476 CF8F.tmp 3012 CFCD.tmp 2856 D00B.tmp 2860 D04A.tmp 2028 D088.tmp 3024 D0D6.tmp 1980 D115.tmp 528 D163.tmp 2056 D1A1.tmp 2332 D1EF.tmp 2084 D23D.tmp 1832 D27B.tmp 2352 D2BA.tmp 1568 D308.tmp 1900 D346.tmp 2628 D385.tmp 484 D3D3.tmp 2044 D421.tmp 1984 D45F.tmp 692 D49D.tmp 1028 D4DC.tmp 1852 D52A.tmp 1892 D587.tmp 972 D604.tmp 1720 D681.tmp 1464 D6FE.tmp 1668 D74C.tmp 1752 D79A.tmp 2576 D817.tmp 560 D855.tmp 888 D8B3.tmp 2436 D8F1.tmp 2552 D93F.tmp 1876 D97D.tmp 2432 D9BC.tmp 1532 DA39.tmp 2276 DAC5.tmp 2244 DB13.tmp 1572 DB51.tmp 3068 DB90.tmp 2308 DBCE.tmp 1236 DC0D.tmp 804 DC5B.tmp 2768 DCA9.tmp 2672 DCE7.tmp 2664 DD35.tmp 2696 DD73.tmp 2948 DDC2.tmp 2840 DE00.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ECA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D105.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8871.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D079.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F077.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F631.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B9F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A100.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E15A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4634.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3237.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3997.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FBE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E225.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1672 wrote to memory of 2304 1672 2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe 30 PID 1672 wrote to memory of 2304 1672 2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe 30 PID 1672 wrote to memory of 2304 1672 2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe 30 PID 1672 wrote to memory of 2304 1672 2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe 30 PID 2304 wrote to memory of 2300 2304 CBA8.tmp 31 PID 2304 wrote to memory of 2300 2304 CBA8.tmp 31 PID 2304 wrote to memory of 2300 2304 CBA8.tmp 31 PID 2304 wrote to memory of 2300 2304 CBA8.tmp 31 PID 2300 wrote to memory of 576 2300 CC25.tmp 32 PID 2300 wrote to memory of 576 2300 CC25.tmp 32 PID 2300 wrote to memory of 576 2300 CC25.tmp 32 PID 2300 wrote to memory of 576 2300 CC25.tmp 32 PID 576 wrote to memory of 2272 576 CC83.tmp 33 PID 576 wrote to memory of 2272 576 CC83.tmp 33 PID 576 wrote to memory of 2272 576 CC83.tmp 33 PID 576 wrote to memory of 2272 576 CC83.tmp 33 PID 2272 wrote to memory of 2828 2272 CCC1.tmp 34 PID 2272 wrote to memory of 2828 2272 CCC1.tmp 34 PID 2272 wrote to memory of 2828 2272 CCC1.tmp 34 PID 2272 wrote to memory of 2828 2272 CCC1.tmp 34 PID 2828 wrote to memory of 2760 2828 CCFF.tmp 35 PID 2828 wrote to memory of 2760 2828 CCFF.tmp 35 PID 2828 wrote to memory of 2760 2828 CCFF.tmp 35 PID 2828 wrote to memory of 2760 2828 CCFF.tmp 35 PID 2760 wrote to memory of 2928 2760 CD3E.tmp 36 PID 2760 wrote to memory of 2928 2760 CD3E.tmp 36 PID 2760 wrote to memory of 2928 2760 CD3E.tmp 36 PID 2760 wrote to memory of 2928 2760 CD3E.tmp 36 PID 2928 wrote to memory of 2924 2928 CD7C.tmp 37 PID 2928 wrote to memory of 2924 2928 CD7C.tmp 37 PID 2928 wrote to memory of 2924 2928 CD7C.tmp 37 PID 2928 wrote to memory of 2924 2928 CD7C.tmp 37 PID 2924 wrote to memory of 1692 2924 CDBB.tmp 39 PID 2924 wrote to memory of 1692 2924 CDBB.tmp 39 PID 2924 wrote to memory of 1692 2924 CDBB.tmp 39 PID 2924 wrote to memory of 1692 2924 CDBB.tmp 39 PID 1692 wrote to memory of 2896 1692 CDF9.tmp 40 PID 1692 wrote to memory of 2896 1692 CDF9.tmp 40 PID 1692 wrote to memory of 2896 1692 CDF9.tmp 40 PID 1692 wrote to memory of 2896 1692 CDF9.tmp 40 PID 2896 wrote to memory of 2764 2896 CE37.tmp 41 PID 2896 wrote to memory of 2764 2896 CE37.tmp 41 PID 2896 wrote to memory of 2764 2896 CE37.tmp 41 PID 2896 wrote to memory of 2764 2896 CE37.tmp 41 PID 2764 wrote to memory of 2676 2764 CE85.tmp 42 PID 2764 wrote to memory of 2676 2764 CE85.tmp 42 PID 2764 wrote to memory of 2676 2764 CE85.tmp 42 PID 2764 wrote to memory of 2676 2764 CE85.tmp 42 PID 2676 wrote to memory of 1888 2676 CEC4.tmp 43 PID 2676 wrote to memory of 1888 2676 CEC4.tmp 43 PID 2676 wrote to memory of 1888 2676 CEC4.tmp 43 PID 2676 wrote to memory of 1888 2676 CEC4.tmp 43 PID 1888 wrote to memory of 1792 1888 CF02.tmp 44 PID 1888 wrote to memory of 1792 1888 CF02.tmp 44 PID 1888 wrote to memory of 1792 1888 CF02.tmp 44 PID 1888 wrote to memory of 1792 1888 CF02.tmp 44 PID 1792 wrote to memory of 1476 1792 CF50.tmp 45 PID 1792 wrote to memory of 1476 1792 CF50.tmp 45 PID 1792 wrote to memory of 1476 1792 CF50.tmp 45 PID 1792 wrote to memory of 1476 1792 CF50.tmp 45 PID 1476 wrote to memory of 3012 1476 CF8F.tmp 46 PID 1476 wrote to memory of 3012 1476 CF8F.tmp 46 PID 1476 wrote to memory of 3012 1476 CF8F.tmp 46 PID 1476 wrote to memory of 3012 1476 CF8F.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-07_721edb16d1774ae3ddb8296d72194c24_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:576 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D49D.tmp"C:\Users\Admin\AppData\Local\Temp\D49D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:692 -
C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"C:\Users\Admin\AppData\Local\Temp\D4DC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"C:\Users\Admin\AppData\Local\Temp\D6FE.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"51⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"52⤵
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\DB51.tmp"C:\Users\Admin\AppData\Local\Temp\DB51.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"C:\Users\Admin\AppData\Local\Temp\DC0D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"66⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"67⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"68⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"69⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"70⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"71⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"72⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"73⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"74⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"75⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"77⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"78⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\E225.tmp"C:\Users\Admin\AppData\Local\Temp\E225.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:968 -
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"80⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"C:\Users\Admin\AppData\Local\Temp\E2A2.tmp"81⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"82⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"83⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"84⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"85⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\E418.tmp"C:\Users\Admin\AppData\Local\Temp\E418.tmp"86⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"87⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"88⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"89⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"90⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"91⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"C:\Users\Admin\AppData\Local\Temp\E5AE.tmp"92⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"93⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\E62A.tmp"C:\Users\Admin\AppData\Local\Temp\E62A.tmp"94⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"95⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"96⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"97⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"98⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"99⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"100⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"101⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"102⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"103⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"C:\Users\Admin\AppData\Local\Temp\E8BA.tmp"104⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"C:\Users\Admin\AppData\Local\Temp\E8F8.tmp"105⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\E936.tmp"C:\Users\Admin\AppData\Local\Temp\E936.tmp"106⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"107⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"108⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"109⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"110⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"111⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"112⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"113⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"C:\Users\Admin\AppData\Local\Temp\EBA6.tmp"115⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"116⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"117⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"118⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"119⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"121⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"122⤵PID:2500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-