Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 09:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe
-
Size
527KB
-
MD5
f41a737d67489da5f84648c62c4132e5
-
SHA1
ed860b78cf448dfd4440051da2b25537f12da73e
-
SHA256
9c98c8d9dbef1220e53facd959a4314d341139888d040f6fcf4c22f75dc7a463
-
SHA512
9f8579decb43caa45d1e656af5dde5e7ed4073d60bcd3b9ed3bd18b5b20ea11a54f0c69a12279b32863911e10ee2bc323cc48d1ec1142db7a4eca8f5c1e44a09
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYIIStaoTNisOMK1NbglcuIG02nzvKPFaxqZs0:fU5rCOTeidDFAsOp1NMSuX9yP1eDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2204 C929.tmp 2560 CA13.tmp 2820 CB1C.tmp 2964 CC06.tmp 2880 CD0F.tmp 2296 CDBB.tmp 3052 CE76.tmp 2848 CF41.tmp 2668 CFFC.tmp 2748 D0D6.tmp 1800 D1B1.tmp 2652 D27C.tmp 1892 D327.tmp 2552 D421.tmp 1700 D4CC.tmp 2320 D597.tmp 2948 D643.tmp 2944 D74C.tmp 2208 D807.tmp 1984 D8D2.tmp 2708 D99D.tmp 1072 DA96.tmp 2044 DD83.tmp 1096 DE00.tmp 2116 DE7D.tmp 2640 DEDA.tmp 2084 DF38.tmp 2128 DFA5.tmp 2364 E012.tmp 2104 E08F.tmp 972 E0FC.tmp 1896 E189.tmp 624 E1E6.tmp 2544 E254.tmp 1764 E2D0.tmp 1108 E34D.tmp 1772 E3AB.tmp 2340 E418.tmp 2408 E4A4.tmp 2388 E531.tmp 928 E5BD.tmp 888 E61B.tmp 1088 E688.tmp 740 E6F5.tmp 1736 E791.tmp 1944 E80E.tmp 1484 E87B.tmp 2260 E908.tmp 1516 E965.tmp 2180 E9C3.tmp 660 EA5F.tmp 2584 EAEB.tmp 2752 EB58.tmp 2504 EBE5.tmp 2292 EC52.tmp 2564 ECCF.tmp 2828 ED4C.tmp 2832 EDD8.tmp 2964 EE55.tmp 2676 EED2.tmp 2108 EF4E.tmp 3060 EFBC.tmp 2244 F029.tmp 1128 F0A6.tmp -
Loads dropped DLL 64 IoCs
pid Process 1348 2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe 2204 C929.tmp 2560 CA13.tmp 2820 CB1C.tmp 2964 CC06.tmp 2880 CD0F.tmp 2296 CDBB.tmp 3052 CE76.tmp 2848 CF41.tmp 2668 CFFC.tmp 2748 D0D6.tmp 1800 D1B1.tmp 2652 D27C.tmp 1892 D327.tmp 2552 D421.tmp 1700 D4CC.tmp 2320 D597.tmp 2948 D643.tmp 2944 D74C.tmp 2208 D807.tmp 1984 D8D2.tmp 2708 D99D.tmp 1072 DA96.tmp 2044 DD83.tmp 1096 DE00.tmp 2116 DE7D.tmp 2640 DEDA.tmp 2084 DF38.tmp 2128 DFA5.tmp 2364 E012.tmp 2104 E08F.tmp 972 E0FC.tmp 1896 E189.tmp 624 E1E6.tmp 2544 E254.tmp 1764 E2D0.tmp 1108 E34D.tmp 1772 E3AB.tmp 2340 E418.tmp 2408 E4A4.tmp 2388 E531.tmp 928 E5BD.tmp 888 E61B.tmp 1088 E688.tmp 740 E6F5.tmp 1736 E791.tmp 1944 E80E.tmp 1484 E87B.tmp 2260 E908.tmp 1516 E965.tmp 2180 E9C3.tmp 660 EA5F.tmp 2584 EAEB.tmp 2752 EB58.tmp 2504 EBE5.tmp 2292 EC52.tmp 2564 ECCF.tmp 2828 ED4C.tmp 2832 EDD8.tmp 2964 EE55.tmp 2676 EED2.tmp 2108 EF4E.tmp 3060 EFBC.tmp 2244 F029.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB50.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D25.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C533.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A045.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 59F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D643.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 645E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2858.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 935A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F49C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9109.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A737.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AE0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 2204 1348 2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe 30 PID 1348 wrote to memory of 2204 1348 2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe 30 PID 1348 wrote to memory of 2204 1348 2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe 30 PID 1348 wrote to memory of 2204 1348 2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe 30 PID 2204 wrote to memory of 2560 2204 C929.tmp 31 PID 2204 wrote to memory of 2560 2204 C929.tmp 31 PID 2204 wrote to memory of 2560 2204 C929.tmp 31 PID 2204 wrote to memory of 2560 2204 C929.tmp 31 PID 2560 wrote to memory of 2820 2560 CA13.tmp 32 PID 2560 wrote to memory of 2820 2560 CA13.tmp 32 PID 2560 wrote to memory of 2820 2560 CA13.tmp 32 PID 2560 wrote to memory of 2820 2560 CA13.tmp 32 PID 2820 wrote to memory of 2964 2820 CB1C.tmp 33 PID 2820 wrote to memory of 2964 2820 CB1C.tmp 33 PID 2820 wrote to memory of 2964 2820 CB1C.tmp 33 PID 2820 wrote to memory of 2964 2820 CB1C.tmp 33 PID 2964 wrote to memory of 2880 2964 CC06.tmp 34 PID 2964 wrote to memory of 2880 2964 CC06.tmp 34 PID 2964 wrote to memory of 2880 2964 CC06.tmp 34 PID 2964 wrote to memory of 2880 2964 CC06.tmp 34 PID 2880 wrote to memory of 2296 2880 CD0F.tmp 35 PID 2880 wrote to memory of 2296 2880 CD0F.tmp 35 PID 2880 wrote to memory of 2296 2880 CD0F.tmp 35 PID 2880 wrote to memory of 2296 2880 CD0F.tmp 35 PID 2296 wrote to memory of 3052 2296 CDBB.tmp 36 PID 2296 wrote to memory of 3052 2296 CDBB.tmp 36 PID 2296 wrote to memory of 3052 2296 CDBB.tmp 36 PID 2296 wrote to memory of 3052 2296 CDBB.tmp 36 PID 3052 wrote to memory of 2848 3052 CE76.tmp 37 PID 3052 wrote to memory of 2848 3052 CE76.tmp 37 PID 3052 wrote to memory of 2848 3052 CE76.tmp 37 PID 3052 wrote to memory of 2848 3052 CE76.tmp 37 PID 2848 wrote to memory of 2668 2848 CF41.tmp 38 PID 2848 wrote to memory of 2668 2848 CF41.tmp 38 PID 2848 wrote to memory of 2668 2848 CF41.tmp 38 PID 2848 wrote to memory of 2668 2848 CF41.tmp 38 PID 2668 wrote to memory of 2748 2668 CFFC.tmp 39 PID 2668 wrote to memory of 2748 2668 CFFC.tmp 39 PID 2668 wrote to memory of 2748 2668 CFFC.tmp 39 PID 2668 wrote to memory of 2748 2668 CFFC.tmp 39 PID 2748 wrote to memory of 1800 2748 D0D6.tmp 40 PID 2748 wrote to memory of 1800 2748 D0D6.tmp 40 PID 2748 wrote to memory of 1800 2748 D0D6.tmp 40 PID 2748 wrote to memory of 1800 2748 D0D6.tmp 40 PID 1800 wrote to memory of 2652 1800 D1B1.tmp 41 PID 1800 wrote to memory of 2652 1800 D1B1.tmp 41 PID 1800 wrote to memory of 2652 1800 D1B1.tmp 41 PID 1800 wrote to memory of 2652 1800 D1B1.tmp 41 PID 2652 wrote to memory of 1892 2652 D27C.tmp 42 PID 2652 wrote to memory of 1892 2652 D27C.tmp 42 PID 2652 wrote to memory of 1892 2652 D27C.tmp 42 PID 2652 wrote to memory of 1892 2652 D27C.tmp 42 PID 1892 wrote to memory of 2552 1892 D327.tmp 43 PID 1892 wrote to memory of 2552 1892 D327.tmp 43 PID 1892 wrote to memory of 2552 1892 D327.tmp 43 PID 1892 wrote to memory of 2552 1892 D327.tmp 43 PID 2552 wrote to memory of 1700 2552 D421.tmp 44 PID 2552 wrote to memory of 1700 2552 D421.tmp 44 PID 2552 wrote to memory of 1700 2552 D421.tmp 44 PID 2552 wrote to memory of 1700 2552 D421.tmp 44 PID 1700 wrote to memory of 2320 1700 D4CC.tmp 45 PID 1700 wrote to memory of 2320 1700 D4CC.tmp 45 PID 1700 wrote to memory of 2320 1700 D4CC.tmp 45 PID 1700 wrote to memory of 2320 1700 D4CC.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_f41a737d67489da5f84648c62c4132e5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"C:\Users\Admin\AppData\Local\Temp\CB1C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"C:\Users\Admin\AppData\Local\Temp\D0D6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\D27C.tmp"C:\Users\Admin\AppData\Local\Temp\D27C.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\D421.tmp"C:\Users\Admin\AppData\Local\Temp\D421.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"C:\Users\Admin\AppData\Local\Temp\D8D2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"C:\Users\Admin\AppData\Local\Temp\DEDA.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\E08F.tmp"C:\Users\Admin\AppData\Local\Temp\E08F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"C:\Users\Admin\AppData\Local\Temp\E1E6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\E418.tmp"C:\Users\Admin\AppData\Local\Temp\E418.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:928 -
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\E688.tmp"C:\Users\Admin\AppData\Local\Temp\E688.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:740 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\E87B.tmp"C:\Users\Admin\AppData\Local\Temp\E87B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\E965.tmp"C:\Users\Admin\AppData\Local\Temp\E965.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:660 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\EB58.tmp"C:\Users\Admin\AppData\Local\Temp\EB58.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"C:\Users\Admin\AppData\Local\Temp\EBE5.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\EC52.tmp"C:\Users\Admin\AppData\Local\Temp\EC52.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\EED2.tmp"C:\Users\Admin\AppData\Local\Temp\EED2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"C:\Users\Admin\AppData\Local\Temp\EF4E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\F029.tmp"C:\Users\Admin\AppData\Local\Temp\F029.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"65⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\F132.tmp"C:\Users\Admin\AppData\Local\Temp\F132.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"67⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\F383.tmp"C:\Users\Admin\AppData\Local\Temp\F383.tmp"68⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"69⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"70⤵
- System Location Discovery: System Language Discovery
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"71⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"72⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"73⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"74⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"C:\Users\Admin\AppData\Local\Temp\F6FC.tmp"75⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\F788.tmp"C:\Users\Admin\AppData\Local\Temp\F788.tmp"76⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"77⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\F853.tmp"C:\Users\Admin\AppData\Local\Temp\F853.tmp"78⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"79⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\F94D.tmp"C:\Users\Admin\AppData\Local\Temp\F94D.tmp"80⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"81⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\FA56.tmp"C:\Users\Admin\AppData\Local\Temp\FA56.tmp"82⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"C:\Users\Admin\AppData\Local\Temp\FAE2.tmp"83⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\FB50.tmp"C:\Users\Admin\AppData\Local\Temp\FB50.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"85⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"86⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"87⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"88⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"89⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"90⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"91⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\FF07.tmp"C:\Users\Admin\AppData\Local\Temp\FF07.tmp"92⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"93⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"95⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"96⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"97⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"98⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"99⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"100⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"101⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"102⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"103⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"104⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\510.tmp"C:\Users\Admin\AppData\Local\Temp\510.tmp"105⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5EA.tmp"C:\Users\Admin\AppData\Local\Temp\5EA.tmp"107⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"108⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\6C4.tmp"C:\Users\Admin\AppData\Local\Temp\6C4.tmp"109⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"110⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"111⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"112⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"113⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"114⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"115⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"116⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"117⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"118⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"119⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"120⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"121⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"122⤵
- System Location Discovery: System Language Discovery
PID:960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-