Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/09/2024, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe
-
Size
527KB
-
MD5
a1519cbc6b0526ec6461bf05a679f521
-
SHA1
10c1d2a4717156f538b2fbc7548ffc1220fa040e
-
SHA256
647b378787d714c07e257a07318e967847d1dbf9dfec5f63c5472ea78413ac01
-
SHA512
2bcd5bd9b84ee9f85c94778b944ac6e5df60935c2c523dd8af002303dc11c14b80145225f584d1d3e189c89b48448385917b4f1a610f96762171dd465171d0f0
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYEv4IAi3gG7N6xcDLrnu0a8OATNlH4DlrblZk:fU5rCOTeidm5Y6xc3D4DlrJZ1lbDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1936 DF96.tmp 2968 E012.tmp 3012 E09F.tmp 2624 E10C.tmp 2660 E179.tmp 2788 E215.tmp 2200 E292.tmp 3064 E2FF.tmp 2736 E37C.tmp 2700 E3F9.tmp 2536 E476.tmp 2604 E4F2.tmp 2260 E56F.tmp 1712 E5EC.tmp 2052 E669.tmp 1896 E6E6.tmp 1460 E753.tmp 912 E7B0.tmp 1424 E81E.tmp 1412 E86C.tmp 2284 E8D9.tmp 1704 E965.tmp 2520 E9D2.tmp 2036 EA11.tmp 2572 EA4F.tmp 2360 EA8E.tmp 2392 EACC.tmp 2708 EB1A.tmp 2936 EB58.tmp 1104 EB97.tmp 1996 EBD5.tmp 2828 EC14.tmp 1228 EC52.tmp 956 ECA0.tmp 1916 ECDE.tmp 1900 ED1D.tmp 1948 ED5B.tmp 2240 ED9A.tmp 2304 EDD8.tmp 1632 EE16.tmp 788 EE55.tmp 676 EE93.tmp 1904 EED2.tmp 684 EF10.tmp 2288 EF4E.tmp 2088 EF8D.tmp 808 EFCB.tmp 1596 F00A.tmp 488 F048.tmp 896 F096.tmp 2064 F0D4.tmp 2296 F113.tmp 1512 F151.tmp 1548 F190.tmp 1936 F1CE.tmp 2480 F20C.tmp 2976 F24B.tmp 3012 F289.tmp 2672 F2C8.tmp 2624 F325.tmp 2728 F364.tmp 2740 F3A2.tmp 2756 F3E0.tmp 2904 F41F.tmp -
Loads dropped DLL 64 IoCs
pid Process 2948 2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe 1936 DF96.tmp 2968 E012.tmp 3012 E09F.tmp 2624 E10C.tmp 2660 E179.tmp 2788 E215.tmp 2200 E292.tmp 3064 E2FF.tmp 2736 E37C.tmp 2700 E3F9.tmp 2536 E476.tmp 2604 E4F2.tmp 2260 E56F.tmp 1712 E5EC.tmp 2052 E669.tmp 1896 E6E6.tmp 1460 E753.tmp 912 E7B0.tmp 1424 E81E.tmp 1412 E86C.tmp 2284 E8D9.tmp 1704 E965.tmp 2520 E9D2.tmp 2036 EA11.tmp 2572 EA4F.tmp 2360 EA8E.tmp 2392 EACC.tmp 2708 EB1A.tmp 2936 EB58.tmp 1104 EB97.tmp 1996 EBD5.tmp 2828 EC14.tmp 1228 EC52.tmp 956 ECA0.tmp 1916 ECDE.tmp 1900 ED1D.tmp 1948 ED5B.tmp 2240 ED9A.tmp 2304 EDD8.tmp 1632 EE16.tmp 788 EE55.tmp 676 EE93.tmp 1904 EED2.tmp 684 EF10.tmp 2288 EF4E.tmp 2088 EF8D.tmp 808 EFCB.tmp 1596 F00A.tmp 488 F048.tmp 896 F096.tmp 2064 F0D4.tmp 2296 F113.tmp 1512 F151.tmp 1548 F190.tmp 1936 F1CE.tmp 2480 F20C.tmp 2976 F24B.tmp 3012 F289.tmp 2672 F2C8.tmp 2624 F325.tmp 2728 F364.tmp 2740 F3A2.tmp 2756 F3E0.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B60.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5226.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4ECC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F151.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1936 2948 2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe 31 PID 2948 wrote to memory of 1936 2948 2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe 31 PID 2948 wrote to memory of 1936 2948 2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe 31 PID 2948 wrote to memory of 1936 2948 2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe 31 PID 1936 wrote to memory of 2968 1936 DF96.tmp 32 PID 1936 wrote to memory of 2968 1936 DF96.tmp 32 PID 1936 wrote to memory of 2968 1936 DF96.tmp 32 PID 1936 wrote to memory of 2968 1936 DF96.tmp 32 PID 2968 wrote to memory of 3012 2968 E012.tmp 33 PID 2968 wrote to memory of 3012 2968 E012.tmp 33 PID 2968 wrote to memory of 3012 2968 E012.tmp 33 PID 2968 wrote to memory of 3012 2968 E012.tmp 33 PID 3012 wrote to memory of 2624 3012 E09F.tmp 34 PID 3012 wrote to memory of 2624 3012 E09F.tmp 34 PID 3012 wrote to memory of 2624 3012 E09F.tmp 34 PID 3012 wrote to memory of 2624 3012 E09F.tmp 34 PID 2624 wrote to memory of 2660 2624 E10C.tmp 35 PID 2624 wrote to memory of 2660 2624 E10C.tmp 35 PID 2624 wrote to memory of 2660 2624 E10C.tmp 35 PID 2624 wrote to memory of 2660 2624 E10C.tmp 35 PID 2660 wrote to memory of 2788 2660 E179.tmp 36 PID 2660 wrote to memory of 2788 2660 E179.tmp 36 PID 2660 wrote to memory of 2788 2660 E179.tmp 36 PID 2660 wrote to memory of 2788 2660 E179.tmp 36 PID 2788 wrote to memory of 2200 2788 E215.tmp 37 PID 2788 wrote to memory of 2200 2788 E215.tmp 37 PID 2788 wrote to memory of 2200 2788 E215.tmp 37 PID 2788 wrote to memory of 2200 2788 E215.tmp 37 PID 2200 wrote to memory of 3064 2200 E292.tmp 38 PID 2200 wrote to memory of 3064 2200 E292.tmp 38 PID 2200 wrote to memory of 3064 2200 E292.tmp 38 PID 2200 wrote to memory of 3064 2200 E292.tmp 38 PID 3064 wrote to memory of 2736 3064 E2FF.tmp 39 PID 3064 wrote to memory of 2736 3064 E2FF.tmp 39 PID 3064 wrote to memory of 2736 3064 E2FF.tmp 39 PID 3064 wrote to memory of 2736 3064 E2FF.tmp 39 PID 2736 wrote to memory of 2700 2736 E37C.tmp 40 PID 2736 wrote to memory of 2700 2736 E37C.tmp 40 PID 2736 wrote to memory of 2700 2736 E37C.tmp 40 PID 2736 wrote to memory of 2700 2736 E37C.tmp 40 PID 2700 wrote to memory of 2536 2700 E3F9.tmp 41 PID 2700 wrote to memory of 2536 2700 E3F9.tmp 41 PID 2700 wrote to memory of 2536 2700 E3F9.tmp 41 PID 2700 wrote to memory of 2536 2700 E3F9.tmp 41 PID 2536 wrote to memory of 2604 2536 E476.tmp 42 PID 2536 wrote to memory of 2604 2536 E476.tmp 42 PID 2536 wrote to memory of 2604 2536 E476.tmp 42 PID 2536 wrote to memory of 2604 2536 E476.tmp 42 PID 2604 wrote to memory of 2260 2604 E4F2.tmp 43 PID 2604 wrote to memory of 2260 2604 E4F2.tmp 43 PID 2604 wrote to memory of 2260 2604 E4F2.tmp 43 PID 2604 wrote to memory of 2260 2604 E4F2.tmp 43 PID 2260 wrote to memory of 1712 2260 E56F.tmp 44 PID 2260 wrote to memory of 1712 2260 E56F.tmp 44 PID 2260 wrote to memory of 1712 2260 E56F.tmp 44 PID 2260 wrote to memory of 1712 2260 E56F.tmp 44 PID 1712 wrote to memory of 2052 1712 E5EC.tmp 45 PID 1712 wrote to memory of 2052 1712 E5EC.tmp 45 PID 1712 wrote to memory of 2052 1712 E5EC.tmp 45 PID 1712 wrote to memory of 2052 1712 E5EC.tmp 45 PID 2052 wrote to memory of 1896 2052 E669.tmp 46 PID 2052 wrote to memory of 1896 2052 E669.tmp 46 PID 2052 wrote to memory of 1896 2052 E669.tmp 46 PID 2052 wrote to memory of 1896 2052 E669.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-11_a1519cbc6b0526ec6461bf05a679f521_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\E37C.tmp"C:\Users\Admin\AppData\Local\Temp\E37C.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\E476.tmp"C:\Users\Admin\AppData\Local\Temp\E476.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"C:\Users\Admin\AppData\Local\Temp\E4F2.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"C:\Users\Admin\AppData\Local\Temp\E5EC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"C:\Users\Admin\AppData\Local\Temp\E6E6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\EB97.tmp"C:\Users\Admin\AppData\Local\Temp\EB97.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"C:\Users\Admin\AppData\Local\Temp\EBD5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"C:\Users\Admin\AppData\Local\Temp\ECA0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\EE16.tmp"C:\Users\Admin\AppData\Local\Temp\EE16.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:676 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:684 -
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"C:\Users\Admin\AppData\Local\Temp\EFCB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\F096.tmp"C:\Users\Admin\AppData\Local\Temp\F096.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\F113.tmp"C:\Users\Admin\AppData\Local\Temp\F113.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\F20C.tmp"C:\Users\Admin\AppData\Local\Temp\F20C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\F24B.tmp"C:\Users\Admin\AppData\Local\Temp\F24B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\F325.tmp"C:\Users\Admin\AppData\Local\Temp\F325.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"C:\Users\Admin\AppData\Local\Temp\F3E0.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"65⤵
- Executes dropped EXE
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\F45D.tmp"C:\Users\Admin\AppData\Local\Temp\F45D.tmp"66⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"67⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"C:\Users\Admin\AppData\Local\Temp\F4DA.tmp"68⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\F528.tmp"C:\Users\Admin\AppData\Local\Temp\F528.tmp"69⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\F566.tmp"C:\Users\Admin\AppData\Local\Temp\F566.tmp"70⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"71⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"72⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"73⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"74⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"75⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"76⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"77⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"78⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"79⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"80⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"81⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"82⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"83⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"84⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\F93D.tmp"C:\Users\Admin\AppData\Local\Temp\F93D.tmp"85⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\F97C.tmp"C:\Users\Admin\AppData\Local\Temp\F97C.tmp"86⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"87⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"88⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\FA37.tmp"C:\Users\Admin\AppData\Local\Temp\FA37.tmp"89⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"90⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"C:\Users\Admin\AppData\Local\Temp\FAC3.tmp"91⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\FB02.tmp"C:\Users\Admin\AppData\Local\Temp\FB02.tmp"92⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\FB40.tmp"C:\Users\Admin\AppData\Local\Temp\FB40.tmp"93⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"94⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"C:\Users\Admin\AppData\Local\Temp\FBBD.tmp"95⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"C:\Users\Admin\AppData\Local\Temp\FBFB.tmp"96⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"C:\Users\Admin\AppData\Local\Temp\FC3A.tmp"97⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"98⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"C:\Users\Admin\AppData\Local\Temp\FCB6.tmp"99⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"100⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"101⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"102⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"103⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"C:\Users\Admin\AppData\Local\Temp\FDEE.tmp"104⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"105⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"106⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"107⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"108⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"109⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"110⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"111⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"112⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\20.tmp"C:\Users\Admin\AppData\Local\Temp\20.tmp"113⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\5E.tmp"C:\Users\Admin\AppData\Local\Temp\5E.tmp"114⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"115⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"116⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\11A.tmp"C:\Users\Admin\AppData\Local\Temp\11A.tmp"117⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\158.tmp"C:\Users\Admin\AppData\Local\Temp\158.tmp"118⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\196.tmp"C:\Users\Admin\AppData\Local\Temp\196.tmp"119⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"120⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"121⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"122⤵PID:2976
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-