Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 01:16
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe
-
Size
536KB
-
MD5
c560319aa708f1a3fb92f8459fb8634c
-
SHA1
3fb3035949a126ffe6d3386da3d8b3baebabd740
-
SHA256
c52eb9b8b8e5d98d723123449ed65400e6eccb5afe2fe267c44a149a08689176
-
SHA512
e8fedaa4cd43427bf3b22faec02bee75cb5cd9fd639d7a7d0a99c658982214e8c7b93b2cb6bf34c7e68881cc9748439b9616d8c55b91a4e736f83cbe4f9bad7a
-
SSDEEP
12288:wU5rCOTeiUIA+Vzvn9ajzQeRHvJA/8NYNIZxVJ0ZT9:wUQOJUIJOcebA/8WNIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2084 CE95.tmp 3016 CF12.tmp 2952 CFAE.tmp 2468 D01B.tmp 2820 D0A7.tmp 2968 D115.tmp 2788 D191.tmp 2800 D1FF.tmp 2604 D28B.tmp 2728 D2C9.tmp 2600 D3D3.tmp 1144 D411.tmp 1716 D44F.tmp 1720 D4CC.tmp 1192 D51A.tmp 1296 D568.tmp 1528 D5B6.tmp 1828 D604.tmp 1680 D652.tmp 2472 D691.tmp 3024 D6CF.tmp 1080 D71D.tmp 2232 D76B.tmp 1240 D7A9.tmp 2020 D7E8.tmp 1996 D826.tmp 908 D865.tmp 2988 D8A3.tmp 784 D8E1.tmp 1172 D920.tmp 2136 D95E.tmp 2180 D99D.tmp 2204 D9DB.tmp 2296 DA19.tmp 804 DAE4.tmp 1016 DB32.tmp 1972 DB90.tmp 2220 DC2C.tmp 3008 DC7A.tmp 2264 DCB8.tmp 2892 DCF7.tmp 2812 DD35.tmp 2100 DD64.tmp 2820 DDA2.tmp 572 DDD1.tmp 2760 DE00.tmp 2300 DE4E.tmp 2636 DE8C.tmp 2528 DECB.tmp 2780 DEFA.tmp 3036 DF28.tmp 764 DF57.tmp 1624 DF96.tmp 1684 DFC4.tmp 1036 E003.tmp 2160 E032.tmp 1800 E070.tmp 2924 E0AE.tmp 1852 E0ED.tmp 2932 E13B.tmp 2236 E179.tmp 1888 E1A8.tmp 2016 E1D7.tmp 2668 E215.tmp -
Loads dropped DLL 64 IoCs
pid Process 2144 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 2084 CE95.tmp 3016 CF12.tmp 2952 CFAE.tmp 2468 D01B.tmp 2820 D0A7.tmp 2968 D115.tmp 2788 D191.tmp 2800 D1FF.tmp 2604 D28B.tmp 2728 D2C9.tmp 2600 D3D3.tmp 1144 D411.tmp 1716 D44F.tmp 1720 D4CC.tmp 1192 D51A.tmp 1296 D568.tmp 1528 D5B6.tmp 1828 D604.tmp 1680 D652.tmp 2472 D691.tmp 3024 D6CF.tmp 1080 D71D.tmp 2232 D76B.tmp 1240 D7A9.tmp 2020 D7E8.tmp 1996 D826.tmp 908 D865.tmp 2988 D8A3.tmp 784 D8E1.tmp 1172 D920.tmp 2136 D95E.tmp 2180 D99D.tmp 2204 D9DB.tmp 2296 DA19.tmp 804 DAE4.tmp 1016 DB32.tmp 2376 DBCE.tmp 2220 DC2C.tmp 3008 DC7A.tmp 2264 DCB8.tmp 2892 DCF7.tmp 2812 DD35.tmp 2100 DD64.tmp 2820 DDA2.tmp 572 DDD1.tmp 2760 DE00.tmp 2300 DE4E.tmp 2636 DE8C.tmp 2528 DECB.tmp 2780 DEFA.tmp 3036 DF28.tmp 764 DF57.tmp 1624 DF96.tmp 1684 DFC4.tmp 1036 E003.tmp 2160 E032.tmp 1800 E070.tmp 2924 E0AE.tmp 1852 E0ED.tmp 2932 E13B.tmp 2236 E179.tmp 1888 E1A8.tmp 2016 E1D7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4653.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FE9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F67F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E38C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5734.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C70.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2084 2144 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 31 PID 2144 wrote to memory of 2084 2144 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 31 PID 2144 wrote to memory of 2084 2144 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 31 PID 2144 wrote to memory of 2084 2144 2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe 31 PID 2084 wrote to memory of 3016 2084 CE95.tmp 32 PID 2084 wrote to memory of 3016 2084 CE95.tmp 32 PID 2084 wrote to memory of 3016 2084 CE95.tmp 32 PID 2084 wrote to memory of 3016 2084 CE95.tmp 32 PID 3016 wrote to memory of 2952 3016 CF12.tmp 33 PID 3016 wrote to memory of 2952 3016 CF12.tmp 33 PID 3016 wrote to memory of 2952 3016 CF12.tmp 33 PID 3016 wrote to memory of 2952 3016 CF12.tmp 33 PID 2952 wrote to memory of 2468 2952 CFAE.tmp 34 PID 2952 wrote to memory of 2468 2952 CFAE.tmp 34 PID 2952 wrote to memory of 2468 2952 CFAE.tmp 34 PID 2952 wrote to memory of 2468 2952 CFAE.tmp 34 PID 2468 wrote to memory of 2820 2468 D01B.tmp 75 PID 2468 wrote to memory of 2820 2468 D01B.tmp 75 PID 2468 wrote to memory of 2820 2468 D01B.tmp 75 PID 2468 wrote to memory of 2820 2468 D01B.tmp 75 PID 2820 wrote to memory of 2968 2820 D0A7.tmp 36 PID 2820 wrote to memory of 2968 2820 D0A7.tmp 36 PID 2820 wrote to memory of 2968 2820 D0A7.tmp 36 PID 2820 wrote to memory of 2968 2820 D0A7.tmp 36 PID 2968 wrote to memory of 2788 2968 D115.tmp 37 PID 2968 wrote to memory of 2788 2968 D115.tmp 37 PID 2968 wrote to memory of 2788 2968 D115.tmp 37 PID 2968 wrote to memory of 2788 2968 D115.tmp 37 PID 2788 wrote to memory of 2800 2788 D191.tmp 38 PID 2788 wrote to memory of 2800 2788 D191.tmp 38 PID 2788 wrote to memory of 2800 2788 D191.tmp 38 PID 2788 wrote to memory of 2800 2788 D191.tmp 38 PID 2800 wrote to memory of 2604 2800 D1FF.tmp 39 PID 2800 wrote to memory of 2604 2800 D1FF.tmp 39 PID 2800 wrote to memory of 2604 2800 D1FF.tmp 39 PID 2800 wrote to memory of 2604 2800 D1FF.tmp 39 PID 2604 wrote to memory of 2728 2604 D28B.tmp 40 PID 2604 wrote to memory of 2728 2604 D28B.tmp 40 PID 2604 wrote to memory of 2728 2604 D28B.tmp 40 PID 2604 wrote to memory of 2728 2604 D28B.tmp 40 PID 2728 wrote to memory of 2600 2728 D2C9.tmp 41 PID 2728 wrote to memory of 2600 2728 D2C9.tmp 41 PID 2728 wrote to memory of 2600 2728 D2C9.tmp 41 PID 2728 wrote to memory of 2600 2728 D2C9.tmp 41 PID 2600 wrote to memory of 1144 2600 D3D3.tmp 42 PID 2600 wrote to memory of 1144 2600 D3D3.tmp 42 PID 2600 wrote to memory of 1144 2600 D3D3.tmp 42 PID 2600 wrote to memory of 1144 2600 D3D3.tmp 42 PID 1144 wrote to memory of 1716 1144 D411.tmp 43 PID 1144 wrote to memory of 1716 1144 D411.tmp 43 PID 1144 wrote to memory of 1716 1144 D411.tmp 43 PID 1144 wrote to memory of 1716 1144 D411.tmp 43 PID 1716 wrote to memory of 1720 1716 D44F.tmp 44 PID 1716 wrote to memory of 1720 1716 D44F.tmp 44 PID 1716 wrote to memory of 1720 1716 D44F.tmp 44 PID 1716 wrote to memory of 1720 1716 D44F.tmp 44 PID 1720 wrote to memory of 1192 1720 D4CC.tmp 45 PID 1720 wrote to memory of 1192 1720 D4CC.tmp 45 PID 1720 wrote to memory of 1192 1720 D4CC.tmp 45 PID 1720 wrote to memory of 1192 1720 D4CC.tmp 45 PID 1192 wrote to memory of 1296 1192 D51A.tmp 46 PID 1192 wrote to memory of 1296 1192 D51A.tmp 46 PID 1192 wrote to memory of 1296 1192 D51A.tmp 46 PID 1192 wrote to memory of 1296 1192 D51A.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-13_c560319aa708f1a3fb92f8459fb8634c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\D01B.tmp"C:\Users\Admin\AppData\Local\Temp\D01B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D115.tmp"C:\Users\Admin\AppData\Local\Temp\D115.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D191.tmp"C:\Users\Admin\AppData\Local\Temp\D191.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D28B.tmp"C:\Users\Admin\AppData\Local\Temp\D28B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"C:\Users\Admin\AppData\Local\Temp\D3D3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\D411.tmp"C:\Users\Admin\AppData\Local\Temp\D411.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\D44F.tmp"C:\Users\Admin\AppData\Local\Temp\D44F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"C:\Users\Admin\AppData\Local\Temp\D4CC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\D51A.tmp"C:\Users\Admin\AppData\Local\Temp\D51A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\D691.tmp"C:\Users\Admin\AppData\Local\Temp\D691.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"C:\Users\Admin\AppData\Local\Temp\D7A9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"38⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"C:\Users\Admin\AppData\Local\Temp\DBCE.tmp"39⤵
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"C:\Users\Admin\AppData\Local\Temp\DEFA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\DF96.tmp"C:\Users\Admin\AppData\Local\Temp\DF96.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"C:\Users\Admin\AppData\Local\Temp\DFC4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\E003.tmp"C:\Users\Admin\AppData\Local\Temp\E003.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\E070.tmp"C:\Users\Admin\AppData\Local\Temp\E070.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"C:\Users\Admin\AppData\Local\Temp\E0AE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"C:\Users\Admin\AppData\Local\Temp\E0ED.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\E13B.tmp"C:\Users\Admin\AppData\Local\Temp\E13B.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\E179.tmp"C:\Users\Admin\AppData\Local\Temp\E179.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"C:\Users\Admin\AppData\Local\Temp\E1A8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"66⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"67⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\E273.tmp"C:\Users\Admin\AppData\Local\Temp\E273.tmp"68⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"69⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"70⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\E31E.tmp"C:\Users\Admin\AppData\Local\Temp\E31E.tmp"71⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"72⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:448 -
C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"C:\Users\Admin\AppData\Local\Temp\E3BA.tmp"74⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"C:\Users\Admin\AppData\Local\Temp\E3E9.tmp"75⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\E437.tmp"C:\Users\Admin\AppData\Local\Temp\E437.tmp"76⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"77⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"C:\Users\Admin\AppData\Local\Temp\E4D3.tmp"78⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"79⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\E56F.tmp"C:\Users\Admin\AppData\Local\Temp\E56F.tmp"80⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"C:\Users\Admin\AppData\Local\Temp\E5CD.tmp"81⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"82⤵PID:332
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"83⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"84⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\E724.tmp"C:\Users\Admin\AppData\Local\Temp\E724.tmp"85⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"86⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"87⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"88⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"89⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\E89A.tmp"C:\Users\Admin\AppData\Local\Temp\E89A.tmp"90⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"91⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\E946.tmp"C:\Users\Admin\AppData\Local\Temp\E946.tmp"92⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"93⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"C:\Users\Admin\AppData\Local\Temp\E9D2.tmp"94⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\EA30.tmp"C:\Users\Admin\AppData\Local\Temp\EA30.tmp"95⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"C:\Users\Admin\AppData\Local\Temp\EA6E.tmp"96⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"97⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"C:\Users\Admin\AppData\Local\Temp\EAFB.tmp"98⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\EB39.tmp"C:\Users\Admin\AppData\Local\Temp\EB39.tmp"99⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\EB87.tmp"C:\Users\Admin\AppData\Local\Temp\EB87.tmp"100⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"101⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"102⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"103⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"104⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"C:\Users\Admin\AppData\Local\Temp\ECBF.tmp"105⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"C:\Users\Admin\AppData\Local\Temp\ECFE.tmp"106⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"C:\Users\Admin\AppData\Local\Temp\ED3C.tmp"107⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"108⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"C:\Users\Admin\AppData\Local\Temp\EDB9.tmp"109⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"110⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\EE36.tmp"C:\Users\Admin\AppData\Local\Temp\EE36.tmp"111⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\EE74.tmp"C:\Users\Admin\AppData\Local\Temp\EE74.tmp"112⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"C:\Users\Admin\AppData\Local\Temp\EEB2.tmp"113⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"C:\Users\Admin\AppData\Local\Temp\EEF1.tmp"114⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"115⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"116⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"C:\Users\Admin\AppData\Local\Temp\EFBC.tmp"117⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"118⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\F048.tmp"C:\Users\Admin\AppData\Local\Temp\F048.tmp"119⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\F086.tmp"C:\Users\Admin\AppData\Local\Temp\F086.tmp"120⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"C:\Users\Admin\AppData\Local\Temp\F0C5.tmp"121⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-