Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 01:20
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe
-
Size
487KB
-
MD5
deda2a439fb8d21b9accca13ed593bec
-
SHA1
018f70e41ae51cf8d96219b2057f2194f025d9bd
-
SHA256
26ddf8b119fd3455308d19d08ff0a18ae156084bff04116433afd3f07bef9b9c
-
SHA512
3cc8d1339aac2468fc17a2cfd39ea5aafc6bda37f8cf6fb0625996f726a32f0557ffa0760f05385950ada048ff8b91e1d1cf1a2ef8132e7ea1ba3cb3625ebd67
-
SSDEEP
12288:HU5rCOTeiJDDvcxmafeC3lROIMPXy2wNZ:HUQOJJDYxmTCzOVXyfN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2068 D375.tmp 1860 D3D3.tmp 480 D45F.tmp 2060 D4BD.tmp 568 D52A.tmp 2724 D597.tmp 2860 D5E5.tmp 2584 D643.tmp 2864 D6B0.tmp 2600 D71D.tmp 2880 D76B.tmp 2596 D7D8.tmp 1900 D845.tmp 2204 D8B3.tmp 1060 D92F.tmp 2008 D98D.tmp 1372 D9FA.tmp 1936 DA58.tmp 2468 DAC5.tmp 1044 DB13.tmp 1976 DB80.tmp 1152 DBED.tmp 2908 DC4B.tmp 2848 DC89.tmp 2220 DCC8.tmp 2184 DD06.tmp 2248 DD45.tmp 2616 DD83.tmp 1696 DDC2.tmp 284 DE00.tmp 348 DE3E.tmp 1040 DE7D.tmp 944 DEBB.tmp 1804 DEFA.tmp 1984 DF38.tmp 2016 DF76.tmp 2192 DFB5.tmp 624 DFF3.tmp 2400 E041.tmp 1796 E080.tmp 1508 E0BE.tmp 2432 E0FC.tmp 3028 E13B.tmp 1748 E179.tmp 2344 E1B8.tmp 2424 E1F6.tmp 2524 E234.tmp 876 E273.tmp 1732 E2B1.tmp 1808 E2F0.tmp 2316 E32E.tmp 2072 E36C.tmp 2896 E3AB.tmp 2512 E3E9.tmp 2968 E428.tmp 2380 E466.tmp 480 E4A4.tmp 2092 E4E3.tmp 2680 E521.tmp 2804 E560.tmp 2816 E59E.tmp 2732 E5DC.tmp 2984 E61B.tmp 1148 E659.tmp -
Loads dropped DLL 64 IoCs
pid Process 2896 2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe 2068 D375.tmp 1860 D3D3.tmp 480 D45F.tmp 2060 D4BD.tmp 568 D52A.tmp 2724 D597.tmp 2860 D5E5.tmp 2584 D643.tmp 2864 D6B0.tmp 2600 D71D.tmp 2880 D76B.tmp 2596 D7D8.tmp 1900 D845.tmp 2204 D8B3.tmp 1060 D92F.tmp 2008 D98D.tmp 1372 D9FA.tmp 1936 DA58.tmp 2468 DAC5.tmp 1044 DB13.tmp 1976 DB80.tmp 1152 DBED.tmp 2908 DC4B.tmp 2848 DC89.tmp 2220 DCC8.tmp 2184 DD06.tmp 2248 DD45.tmp 2616 DD83.tmp 1696 DDC2.tmp 284 DE00.tmp 348 DE3E.tmp 1040 DE7D.tmp 944 DEBB.tmp 1804 DEFA.tmp 1984 DF38.tmp 2016 DF76.tmp 2192 DFB5.tmp 624 DFF3.tmp 2400 E041.tmp 1796 E080.tmp 1508 E0BE.tmp 2432 E0FC.tmp 3028 E13B.tmp 1748 E179.tmp 2344 E1B8.tmp 2424 E1F6.tmp 2524 E234.tmp 876 E273.tmp 1732 E2B1.tmp 1808 E2F0.tmp 2316 E32E.tmp 2072 E36C.tmp 2896 E3AB.tmp 2512 E3E9.tmp 2968 E428.tmp 2380 E466.tmp 480 E4A4.tmp 2092 E4E3.tmp 2680 E521.tmp 2804 E560.tmp 2816 E59E.tmp 2732 E5DC.tmp 2984 E61B.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3015.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 539C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B01D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B117.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B38.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C35F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6632.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E13B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2068 2896 2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe 31 PID 2896 wrote to memory of 2068 2896 2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe 31 PID 2896 wrote to memory of 2068 2896 2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe 31 PID 2896 wrote to memory of 2068 2896 2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe 31 PID 2068 wrote to memory of 1860 2068 D375.tmp 32 PID 2068 wrote to memory of 1860 2068 D375.tmp 32 PID 2068 wrote to memory of 1860 2068 D375.tmp 32 PID 2068 wrote to memory of 1860 2068 D375.tmp 32 PID 1860 wrote to memory of 480 1860 D3D3.tmp 33 PID 1860 wrote to memory of 480 1860 D3D3.tmp 33 PID 1860 wrote to memory of 480 1860 D3D3.tmp 33 PID 1860 wrote to memory of 480 1860 D3D3.tmp 33 PID 480 wrote to memory of 2060 480 D45F.tmp 34 PID 480 wrote to memory of 2060 480 D45F.tmp 34 PID 480 wrote to memory of 2060 480 D45F.tmp 34 PID 480 wrote to memory of 2060 480 D45F.tmp 34 PID 2060 wrote to memory of 568 2060 D4BD.tmp 35 PID 2060 wrote to memory of 568 2060 D4BD.tmp 35 PID 2060 wrote to memory of 568 2060 D4BD.tmp 35 PID 2060 wrote to memory of 568 2060 D4BD.tmp 35 PID 568 wrote to memory of 2724 568 D52A.tmp 36 PID 568 wrote to memory of 2724 568 D52A.tmp 36 PID 568 wrote to memory of 2724 568 D52A.tmp 36 PID 568 wrote to memory of 2724 568 D52A.tmp 36 PID 2724 wrote to memory of 2860 2724 D597.tmp 37 PID 2724 wrote to memory of 2860 2724 D597.tmp 37 PID 2724 wrote to memory of 2860 2724 D597.tmp 37 PID 2724 wrote to memory of 2860 2724 D597.tmp 37 PID 2860 wrote to memory of 2584 2860 D5E5.tmp 38 PID 2860 wrote to memory of 2584 2860 D5E5.tmp 38 PID 2860 wrote to memory of 2584 2860 D5E5.tmp 38 PID 2860 wrote to memory of 2584 2860 D5E5.tmp 38 PID 2584 wrote to memory of 2864 2584 D643.tmp 39 PID 2584 wrote to memory of 2864 2584 D643.tmp 39 PID 2584 wrote to memory of 2864 2584 D643.tmp 39 PID 2584 wrote to memory of 2864 2584 D643.tmp 39 PID 2864 wrote to memory of 2600 2864 D6B0.tmp 40 PID 2864 wrote to memory of 2600 2864 D6B0.tmp 40 PID 2864 wrote to memory of 2600 2864 D6B0.tmp 40 PID 2864 wrote to memory of 2600 2864 D6B0.tmp 40 PID 2600 wrote to memory of 2880 2600 D71D.tmp 41 PID 2600 wrote to memory of 2880 2600 D71D.tmp 41 PID 2600 wrote to memory of 2880 2600 D71D.tmp 41 PID 2600 wrote to memory of 2880 2600 D71D.tmp 41 PID 2880 wrote to memory of 2596 2880 D76B.tmp 42 PID 2880 wrote to memory of 2596 2880 D76B.tmp 42 PID 2880 wrote to memory of 2596 2880 D76B.tmp 42 PID 2880 wrote to memory of 2596 2880 D76B.tmp 42 PID 2596 wrote to memory of 1900 2596 D7D8.tmp 43 PID 2596 wrote to memory of 1900 2596 D7D8.tmp 43 PID 2596 wrote to memory of 1900 2596 D7D8.tmp 43 PID 2596 wrote to memory of 1900 2596 D7D8.tmp 43 PID 1900 wrote to memory of 2204 1900 D845.tmp 44 PID 1900 wrote to memory of 2204 1900 D845.tmp 44 PID 1900 wrote to memory of 2204 1900 D845.tmp 44 PID 1900 wrote to memory of 2204 1900 D845.tmp 44 PID 2204 wrote to memory of 1060 2204 D8B3.tmp 45 PID 2204 wrote to memory of 1060 2204 D8B3.tmp 45 PID 2204 wrote to memory of 1060 2204 D8B3.tmp 45 PID 2204 wrote to memory of 1060 2204 D8B3.tmp 45 PID 1060 wrote to memory of 2008 1060 D92F.tmp 46 PID 1060 wrote to memory of 2008 1060 D92F.tmp 46 PID 1060 wrote to memory of 2008 1060 D92F.tmp 46 PID 1060 wrote to memory of 2008 1060 D92F.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-21_deda2a439fb8d21b9accca13ed593bec_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:480 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Users\Admin\AppData\Local\Temp\D597.tmp"C:\Users\Admin\AppData\Local\Temp\D597.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\DB13.tmp"C:\Users\Admin\AppData\Local\Temp\DB13.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"C:\Users\Admin\AppData\Local\Temp\DC4B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\DC89.tmp"C:\Users\Admin\AppData\Local\Temp\DC89.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\DD06.tmp"C:\Users\Admin\AppData\Local\Temp\DD06.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\DD45.tmp"C:\Users\Admin\AppData\Local\Temp\DD45.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\DD83.tmp"C:\Users\Admin\AppData\Local\Temp\DD83.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:348 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"C:\Users\Admin\AppData\Local\Temp\DEBB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\DF38.tmp"C:\Users\Admin\AppData\Local\Temp\DF38.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\DF76.tmp"C:\Users\Admin\AppData\Local\Temp\DF76.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"C:\Users\Admin\AppData\Local\Temp\DFB5.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"C:\Users\Admin\AppData\Local\Temp\DFF3.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:624 -
C:\Users\Admin\AppData\Local\Temp\E041.tmp"C:\Users\Admin\AppData\Local\Temp\E041.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"C:\Users\Admin\AppData\Local\Temp\E0FC.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"C:\Users\Admin\AppData\Local\Temp\E1B8.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"C:\Users\Admin\AppData\Local\Temp\E1F6.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\E234.tmp"C:\Users\Admin\AppData\Local\Temp\E234.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\E32E.tmp"C:\Users\Admin\AppData\Local\Temp\E32E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\E36C.tmp"C:\Users\Admin\AppData\Local\Temp\E36C.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\E428.tmp"C:\Users\Admin\AppData\Local\Temp\E428.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"C:\Users\Admin\AppData\Local\Temp\E4A4.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"C:\Users\Admin\AppData\Local\Temp\E4E3.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\E521.tmp"C:\Users\Admin\AppData\Local\Temp\E521.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\E560.tmp"C:\Users\Admin\AppData\Local\Temp\E560.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"65⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\E698.tmp"C:\Users\Admin\AppData\Local\Temp\E698.tmp"66⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"C:\Users\Admin\AppData\Local\Temp\E6D6.tmp"67⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"68⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\E753.tmp"C:\Users\Admin\AppData\Local\Temp\E753.tmp"69⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"70⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"C:\Users\Admin\AppData\Local\Temp\E7D0.tmp"71⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\E80E.tmp"C:\Users\Admin\AppData\Local\Temp\E80E.tmp"72⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"73⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"74⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"75⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"76⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\E946.tmp"C:\Users\Admin\AppData\Local\Temp\E946.tmp"77⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\E984.tmp"C:\Users\Admin\AppData\Local\Temp\E984.tmp"78⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"C:\Users\Admin\AppData\Local\Temp\E9C3.tmp"79⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\EA01.tmp"C:\Users\Admin\AppData\Local\Temp\EA01.tmp"80⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"C:\Users\Admin\AppData\Local\Temp\EA4F.tmp"81⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"C:\Users\Admin\AppData\Local\Temp\EA8E.tmp"82⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\EACC.tmp"C:\Users\Admin\AppData\Local\Temp\EACC.tmp"83⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"C:\Users\Admin\AppData\Local\Temp\EB0A.tmp"84⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"85⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\EB87.tmp"C:\Users\Admin\AppData\Local\Temp\EB87.tmp"86⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"87⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"88⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"89⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"90⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"91⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"93⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"94⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"95⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"96⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"97⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"98⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"99⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"100⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"101⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"103⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"104⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\F029.tmp"C:\Users\Admin\AppData\Local\Temp\F029.tmp"105⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"106⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"C:\Users\Admin\AppData\Local\Temp\F0A6.tmp"107⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"108⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\F122.tmp"C:\Users\Admin\AppData\Local\Temp\F122.tmp"109⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\F161.tmp"C:\Users\Admin\AppData\Local\Temp\F161.tmp"110⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\F19F.tmp"C:\Users\Admin\AppData\Local\Temp\F19F.tmp"111⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"112⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"113⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\F25A.tmp"C:\Users\Admin\AppData\Local\Temp\F25A.tmp"114⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\F299.tmp"C:\Users\Admin\AppData\Local\Temp\F299.tmp"115⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"116⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\F316.tmp"C:\Users\Admin\AppData\Local\Temp\F316.tmp"117⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\F354.tmp"C:\Users\Admin\AppData\Local\Temp\F354.tmp"118⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"119⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"120⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\F40F.tmp"C:\Users\Admin\AppData\Local\Temp\F40F.tmp"121⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\F44E.tmp"C:\Users\Admin\AppData\Local\Temp\F44E.tmp"122⤵PID:2188
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-