Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 01:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe
-
Size
488KB
-
MD5
34811d1cc6d6b504f831655a987f5298
-
SHA1
04ab4108715168309dac129642d75e3fcdf9485d
-
SHA256
ebe8bff47f66996d50593a608491909759449dfa2c77eb4936a25f52c1f1c888
-
SHA512
4c5ea5a39b3992d977a099af4c63b20cfb0b65b8186c3ec71b943faba0906a6e1b18c29573e67270cbe08b2e8fee49a65ff6b34e8e5a6b9ce339e7b8c92fc618
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7mEKVmArA7wv/sNt7ZoXK/7ZARpo5dicY/5aQ:/U5rCOTeiD3LH7wv0n73ZNPw7NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2872 D643.tmp 2328 D6A0.tmp 2420 D71D.tmp 2820 D76B.tmp 3052 D7C9.tmp 2744 D817.tmp 2900 D855.tmp 2824 D8F1.tmp 2548 D92F.tmp 2884 D98D.tmp 2568 D9CB.tmp 2564 DA19.tmp 2992 DA58.tmp 1544 DA96.tmp 892 DAF4.tmp 2416 DB32.tmp 2032 DB71.tmp 1996 DC2C.tmp 600 DC7A.tmp 2728 DCC8.tmp 1608 DD64.tmp 1912 DDC2.tmp 1040 DE00.tmp 2612 DE3E.tmp 2844 DE7D.tmp 2152 DECB.tmp 2116 DF09.tmp 2124 DF48.tmp 1244 DF86.tmp 3040 DFD4.tmp 1100 E012.tmp 2304 E060.tmp 956 E09F.tmp 1516 E0DD.tmp 1708 E11C.tmp 1736 E15A.tmp 908 E198.tmp 1036 E1D7.tmp 936 E215.tmp 1060 E254.tmp 1548 E292.tmp 1044 E2D0.tmp 2212 E30F.tmp 2440 E34D.tmp 2220 E38C.tmp 2068 E3CA.tmp 3016 E408.tmp 2920 E447.tmp 1004 E485.tmp 2940 E4C4.tmp 2168 E502.tmp 1720 E57F.tmp 2596 E5BD.tmp 2268 E5FC.tmp 2020 E63A.tmp 1828 E678.tmp 896 E6B7.tmp 2668 E6F5.tmp 3028 E734.tmp 2744 E772.tmp 2760 E7B0.tmp 2620 E7EF.tmp 2824 E82D.tmp 356 E86C.tmp -
Loads dropped DLL 64 IoCs
pid Process 3004 2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe 2872 D643.tmp 2328 D6A0.tmp 2420 D71D.tmp 2820 D76B.tmp 3052 D7C9.tmp 2744 D817.tmp 2900 D855.tmp 2824 D8F1.tmp 2548 D92F.tmp 2884 D98D.tmp 2568 D9CB.tmp 2564 DA19.tmp 2992 DA58.tmp 1544 DA96.tmp 892 DAF4.tmp 2416 DB32.tmp 2032 DB71.tmp 1996 DC2C.tmp 600 DC7A.tmp 2728 DCC8.tmp 1608 DD64.tmp 1912 DDC2.tmp 1040 DE00.tmp 2612 DE3E.tmp 2844 DE7D.tmp 2152 DECB.tmp 2116 DF09.tmp 2124 DF48.tmp 1244 DF86.tmp 3040 DFD4.tmp 1100 E012.tmp 2304 E060.tmp 956 E09F.tmp 1516 E0DD.tmp 1708 E11C.tmp 1736 E15A.tmp 908 E198.tmp 1036 E1D7.tmp 936 E215.tmp 1060 E254.tmp 1548 E292.tmp 1044 E2D0.tmp 2212 E30F.tmp 2440 E34D.tmp 2220 E38C.tmp 2068 E3CA.tmp 3016 E408.tmp 2920 E447.tmp 1004 E485.tmp 2940 E4C4.tmp 3008 E540.tmp 1720 E57F.tmp 2596 E5BD.tmp 2268 E5FC.tmp 2020 E63A.tmp 1828 E678.tmp 896 E6B7.tmp 2668 E6F5.tmp 3028 E734.tmp 2744 E772.tmp 2760 E7B0.tmp 2620 E7EF.tmp 2824 E82D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 164E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2424.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E273.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9260.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7649.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A15E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F834.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB97.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E254.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B201.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B922.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F4D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2872 3004 2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe 31 PID 3004 wrote to memory of 2872 3004 2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe 31 PID 3004 wrote to memory of 2872 3004 2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe 31 PID 3004 wrote to memory of 2872 3004 2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe 31 PID 2872 wrote to memory of 2328 2872 D643.tmp 32 PID 2872 wrote to memory of 2328 2872 D643.tmp 32 PID 2872 wrote to memory of 2328 2872 D643.tmp 32 PID 2872 wrote to memory of 2328 2872 D643.tmp 32 PID 2328 wrote to memory of 2420 2328 D6A0.tmp 33 PID 2328 wrote to memory of 2420 2328 D6A0.tmp 33 PID 2328 wrote to memory of 2420 2328 D6A0.tmp 33 PID 2328 wrote to memory of 2420 2328 D6A0.tmp 33 PID 2420 wrote to memory of 2820 2420 D71D.tmp 34 PID 2420 wrote to memory of 2820 2420 D71D.tmp 34 PID 2420 wrote to memory of 2820 2420 D71D.tmp 34 PID 2420 wrote to memory of 2820 2420 D71D.tmp 34 PID 2820 wrote to memory of 3052 2820 D76B.tmp 35 PID 2820 wrote to memory of 3052 2820 D76B.tmp 35 PID 2820 wrote to memory of 3052 2820 D76B.tmp 35 PID 2820 wrote to memory of 3052 2820 D76B.tmp 35 PID 3052 wrote to memory of 2744 3052 D7C9.tmp 91 PID 3052 wrote to memory of 2744 3052 D7C9.tmp 91 PID 3052 wrote to memory of 2744 3052 D7C9.tmp 91 PID 3052 wrote to memory of 2744 3052 D7C9.tmp 91 PID 2744 wrote to memory of 2900 2744 D817.tmp 37 PID 2744 wrote to memory of 2900 2744 D817.tmp 37 PID 2744 wrote to memory of 2900 2744 D817.tmp 37 PID 2744 wrote to memory of 2900 2744 D817.tmp 37 PID 2900 wrote to memory of 2824 2900 D855.tmp 94 PID 2900 wrote to memory of 2824 2900 D855.tmp 94 PID 2900 wrote to memory of 2824 2900 D855.tmp 94 PID 2900 wrote to memory of 2824 2900 D855.tmp 94 PID 2824 wrote to memory of 2548 2824 D8F1.tmp 39 PID 2824 wrote to memory of 2548 2824 D8F1.tmp 39 PID 2824 wrote to memory of 2548 2824 D8F1.tmp 39 PID 2824 wrote to memory of 2548 2824 D8F1.tmp 39 PID 2548 wrote to memory of 2884 2548 D92F.tmp 40 PID 2548 wrote to memory of 2884 2548 D92F.tmp 40 PID 2548 wrote to memory of 2884 2548 D92F.tmp 40 PID 2548 wrote to memory of 2884 2548 D92F.tmp 40 PID 2884 wrote to memory of 2568 2884 D98D.tmp 41 PID 2884 wrote to memory of 2568 2884 D98D.tmp 41 PID 2884 wrote to memory of 2568 2884 D98D.tmp 41 PID 2884 wrote to memory of 2568 2884 D98D.tmp 41 PID 2568 wrote to memory of 2564 2568 D9CB.tmp 42 PID 2568 wrote to memory of 2564 2568 D9CB.tmp 42 PID 2568 wrote to memory of 2564 2568 D9CB.tmp 42 PID 2568 wrote to memory of 2564 2568 D9CB.tmp 42 PID 2564 wrote to memory of 2992 2564 DA19.tmp 43 PID 2564 wrote to memory of 2992 2564 DA19.tmp 43 PID 2564 wrote to memory of 2992 2564 DA19.tmp 43 PID 2564 wrote to memory of 2992 2564 DA19.tmp 43 PID 2992 wrote to memory of 1544 2992 DA58.tmp 44 PID 2992 wrote to memory of 1544 2992 DA58.tmp 44 PID 2992 wrote to memory of 1544 2992 DA58.tmp 44 PID 2992 wrote to memory of 1544 2992 DA58.tmp 44 PID 1544 wrote to memory of 892 1544 DA96.tmp 103 PID 1544 wrote to memory of 892 1544 DA96.tmp 103 PID 1544 wrote to memory of 892 1544 DA96.tmp 103 PID 1544 wrote to memory of 892 1544 DA96.tmp 103 PID 892 wrote to memory of 2416 892 DAF4.tmp 46 PID 892 wrote to memory of 2416 892 DAF4.tmp 46 PID 892 wrote to memory of 2416 892 DAF4.tmp 46 PID 892 wrote to memory of 2416 892 DAF4.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-18_34811d1cc6d6b504f831655a987f5298_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\D92F.tmp"C:\Users\Admin\AppData\Local\Temp\D92F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\D98D.tmp"C:\Users\Admin\AppData\Local\Temp\D98D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"C:\Users\Admin\AppData\Local\Temp\D9CB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DA58.tmp"C:\Users\Admin\AppData\Local\Temp\DA58.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\DA96.tmp"C:\Users\Admin\AppData\Local\Temp\DA96.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\DB32.tmp"C:\Users\Admin\AppData\Local\Temp\DB32.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"C:\Users\Admin\AppData\Local\Temp\DDC2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:936 -
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"52⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"53⤵
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:896 -
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"66⤵
- Executes dropped EXE
PID:356 -
C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"C:\Users\Admin\AppData\Local\Temp\E8E8.tmp"67⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\E927.tmp"C:\Users\Admin\AppData\Local\Temp\E927.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\E975.tmp"C:\Users\Admin\AppData\Local\Temp\E975.tmp"69⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"C:\Users\Admin\AppData\Local\Temp\E9B3.tmp"70⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"71⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\EA40.tmp"C:\Users\Admin\AppData\Local\Temp\EA40.tmp"72⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"C:\Users\Admin\AppData\Local\Temp\EA7E.tmp"73⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"74⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\EB49.tmp"C:\Users\Admin\AppData\Local\Temp\EB49.tmp"75⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"76⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\EC14.tmp"C:\Users\Admin\AppData\Local\Temp\EC14.tmp"77⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"78⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"79⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"80⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"C:\Users\Admin\AppData\Local\Temp\ED7A.tmp"81⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"C:\Users\Admin\AppData\Local\Temp\EDD8.tmp"82⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"83⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"84⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"85⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"C:\Users\Admin\AppData\Local\Temp\EF3F.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"C:\Users\Admin\AppData\Local\Temp\EF8D.tmp"87⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"C:\Users\Admin\AppData\Local\Temp\EFFA.tmp"88⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\F058.tmp"C:\Users\Admin\AppData\Local\Temp\F058.tmp"89⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"90⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\F103.tmp"C:\Users\Admin\AppData\Local\Temp\F103.tmp"91⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"92⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\F190.tmp"C:\Users\Admin\AppData\Local\Temp\F190.tmp"93⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"94⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\F23B.tmp"C:\Users\Admin\AppData\Local\Temp\F23B.tmp"95⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\F289.tmp"C:\Users\Admin\AppData\Local\Temp\F289.tmp"96⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"C:\Users\Admin\AppData\Local\Temp\F2D7.tmp"97⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\F316.tmp"C:\Users\Admin\AppData\Local\Temp\F316.tmp"98⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\F364.tmp"C:\Users\Admin\AppData\Local\Temp\F364.tmp"99⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"100⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"101⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"102⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"103⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"C:\Users\Admin\AppData\Local\Temp\F4BB.tmp"104⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"105⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"106⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\F576.tmp"C:\Users\Admin\AppData\Local\Temp\F576.tmp"107⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"C:\Users\Admin\AppData\Local\Temp\F5B4.tmp"108⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"109⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\F641.tmp"C:\Users\Admin\AppData\Local\Temp\F641.tmp"110⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\F67F.tmp"C:\Users\Admin\AppData\Local\Temp\F67F.tmp"111⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"C:\Users\Admin\AppData\Local\Temp\F6CD.tmp"112⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\F71B.tmp"C:\Users\Admin\AppData\Local\Temp\F71B.tmp"113⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"114⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"115⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"116⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"117⤵
- System Location Discovery: System Language Discovery
PID:268 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"118⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"119⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"C:\Users\Admin\AppData\Local\Temp\F8FF.tmp"120⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\F93D.tmp"C:\Users\Admin\AppData\Local\Temp\F93D.tmp"121⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\F97C.tmp"C:\Users\Admin\AppData\Local\Temp\F97C.tmp"122⤵PID:3068
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-