Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/07/2024, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe
Resource
win10v2004-20240709-en
General
-
Target
2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe
-
Size
488KB
-
MD5
9fbfdcb94cc91418862a3cc5e69de1da
-
SHA1
589ece4864fdbd3a5e5f19475c11d9f2a60c08ee
-
SHA256
8fcc855b62bfc74c9e8cc40f172e3ec89f97952a2879cccabce57516331d0edb
-
SHA512
3dc089e66fd21f707ef37fe0ac72fd3153d2771d1ec5d8c2778a8abffe2069ca5b067e3c298323b117438ffccfff5c1648643e62b143f009eb769333ee8fd00d
-
SSDEEP
12288:/U5rCOTeiDOqdvfO7OqXwzg7DaLsZweWHhbxNZ:/UQOJDOqdX6fXvawZohlN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2448 4F0A.tmp 2780 4F77.tmp 2664 5004.tmp 2564 5071.tmp 2096 50DE.tmp 2692 514B.tmp 2556 51B8.tmp 2620 5226.tmp 2964 5293.tmp 1304 52F0.tmp 2272 534E.tmp 1256 53BB.tmp 2832 5419.tmp 2896 5486.tmp 2188 54E4.tmp 2652 5532.tmp 2980 559F.tmp 2076 560C.tmp 2616 565A.tmp 2108 56C7.tmp 480 5715.tmp 2204 5763.tmp 2000 57C1.tmp 2340 57FF.tmp 2220 584D.tmp 2072 588C.tmp 1616 58CA.tmp 1944 5918.tmp 3040 5966.tmp 1056 59A5.tmp 1588 59E3.tmp 2508 5A21.tmp 2520 5A6F.tmp 616 5AAE.tmp 1736 5AEC.tmp 2044 5B2B.tmp 2500 5B79.tmp 1664 5BB7.tmp 1552 5BF5.tmp 1628 5C34.tmp 1992 5C82.tmp 1532 5CC0.tmp 2352 5CFF.tmp 2484 5D3D.tmp 2200 5D8B.tmp 1760 5DC9.tmp 544 5E17.tmp 1648 5E56.tmp 900 5E94.tmp 1784 5EE2.tmp 2948 5F21.tmp 1916 5F5F.tmp 3044 5FEB.tmp 2764 6049.tmp 2748 6087.tmp 2708 60D5.tmp 2804 6123.tmp 3048 6162.tmp 2732 61A0.tmp 1720 61EE.tmp 2604 622D.tmp 2812 627B.tmp 2608 62B9.tmp 2632 62F7.tmp -
Loads dropped DLL 64 IoCs
pid Process 3024 2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe 2448 4F0A.tmp 2780 4F77.tmp 2664 5004.tmp 2564 5071.tmp 2096 50DE.tmp 2692 514B.tmp 2556 51B8.tmp 2620 5226.tmp 2964 5293.tmp 1304 52F0.tmp 2272 534E.tmp 1256 53BB.tmp 2832 5419.tmp 2896 5486.tmp 2188 54E4.tmp 2652 5532.tmp 2980 559F.tmp 2076 560C.tmp 2616 565A.tmp 2108 56C7.tmp 480 5715.tmp 2204 5763.tmp 2000 57C1.tmp 2340 57FF.tmp 2220 584D.tmp 2072 588C.tmp 1616 58CA.tmp 1944 5918.tmp 3040 5966.tmp 1056 59A5.tmp 1588 59E3.tmp 2508 5A21.tmp 2520 5A6F.tmp 616 5AAE.tmp 1736 5AEC.tmp 2044 5B2B.tmp 2500 5B79.tmp 1664 5BB7.tmp 1552 5BF5.tmp 1628 5C34.tmp 1992 5C82.tmp 1532 5CC0.tmp 2352 5CFF.tmp 2484 5D3D.tmp 2200 5D8B.tmp 1760 5DC9.tmp 544 5E17.tmp 1648 5E56.tmp 900 5E94.tmp 1784 5EE2.tmp 2948 5F21.tmp 2704 5FAD.tmp 3044 5FEB.tmp 2764 6049.tmp 2748 6087.tmp 2708 60D5.tmp 2804 6123.tmp 3048 6162.tmp 2732 61A0.tmp 1720 61EE.tmp 2604 622D.tmp 2812 627B.tmp 2608 62B9.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D23.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D633.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3082.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2202.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F892.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B74E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2448 3024 2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe 30 PID 3024 wrote to memory of 2448 3024 2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe 30 PID 3024 wrote to memory of 2448 3024 2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe 30 PID 3024 wrote to memory of 2448 3024 2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe 30 PID 2448 wrote to memory of 2780 2448 4F0A.tmp 31 PID 2448 wrote to memory of 2780 2448 4F0A.tmp 31 PID 2448 wrote to memory of 2780 2448 4F0A.tmp 31 PID 2448 wrote to memory of 2780 2448 4F0A.tmp 31 PID 2780 wrote to memory of 2664 2780 4F77.tmp 32 PID 2780 wrote to memory of 2664 2780 4F77.tmp 32 PID 2780 wrote to memory of 2664 2780 4F77.tmp 32 PID 2780 wrote to memory of 2664 2780 4F77.tmp 32 PID 2664 wrote to memory of 2564 2664 5004.tmp 33 PID 2664 wrote to memory of 2564 2664 5004.tmp 33 PID 2664 wrote to memory of 2564 2664 5004.tmp 33 PID 2664 wrote to memory of 2564 2664 5004.tmp 33 PID 2564 wrote to memory of 2096 2564 5071.tmp 34 PID 2564 wrote to memory of 2096 2564 5071.tmp 34 PID 2564 wrote to memory of 2096 2564 5071.tmp 34 PID 2564 wrote to memory of 2096 2564 5071.tmp 34 PID 2096 wrote to memory of 2692 2096 50DE.tmp 35 PID 2096 wrote to memory of 2692 2096 50DE.tmp 35 PID 2096 wrote to memory of 2692 2096 50DE.tmp 35 PID 2096 wrote to memory of 2692 2096 50DE.tmp 35 PID 2692 wrote to memory of 2556 2692 514B.tmp 36 PID 2692 wrote to memory of 2556 2692 514B.tmp 36 PID 2692 wrote to memory of 2556 2692 514B.tmp 36 PID 2692 wrote to memory of 2556 2692 514B.tmp 36 PID 2556 wrote to memory of 2620 2556 51B8.tmp 37 PID 2556 wrote to memory of 2620 2556 51B8.tmp 37 PID 2556 wrote to memory of 2620 2556 51B8.tmp 37 PID 2556 wrote to memory of 2620 2556 51B8.tmp 37 PID 2620 wrote to memory of 2964 2620 5226.tmp 38 PID 2620 wrote to memory of 2964 2620 5226.tmp 38 PID 2620 wrote to memory of 2964 2620 5226.tmp 38 PID 2620 wrote to memory of 2964 2620 5226.tmp 38 PID 2964 wrote to memory of 1304 2964 5293.tmp 39 PID 2964 wrote to memory of 1304 2964 5293.tmp 39 PID 2964 wrote to memory of 1304 2964 5293.tmp 39 PID 2964 wrote to memory of 1304 2964 5293.tmp 39 PID 1304 wrote to memory of 2272 1304 52F0.tmp 40 PID 1304 wrote to memory of 2272 1304 52F0.tmp 40 PID 1304 wrote to memory of 2272 1304 52F0.tmp 40 PID 1304 wrote to memory of 2272 1304 52F0.tmp 40 PID 2272 wrote to memory of 1256 2272 534E.tmp 41 PID 2272 wrote to memory of 1256 2272 534E.tmp 41 PID 2272 wrote to memory of 1256 2272 534E.tmp 41 PID 2272 wrote to memory of 1256 2272 534E.tmp 41 PID 1256 wrote to memory of 2832 1256 53BB.tmp 42 PID 1256 wrote to memory of 2832 1256 53BB.tmp 42 PID 1256 wrote to memory of 2832 1256 53BB.tmp 42 PID 1256 wrote to memory of 2832 1256 53BB.tmp 42 PID 2832 wrote to memory of 2896 2832 5419.tmp 43 PID 2832 wrote to memory of 2896 2832 5419.tmp 43 PID 2832 wrote to memory of 2896 2832 5419.tmp 43 PID 2832 wrote to memory of 2896 2832 5419.tmp 43 PID 2896 wrote to memory of 2188 2896 5486.tmp 44 PID 2896 wrote to memory of 2188 2896 5486.tmp 44 PID 2896 wrote to memory of 2188 2896 5486.tmp 44 PID 2896 wrote to memory of 2188 2896 5486.tmp 44 PID 2188 wrote to memory of 2652 2188 54E4.tmp 45 PID 2188 wrote to memory of 2652 2188 54E4.tmp 45 PID 2188 wrote to memory of 2652 2188 54E4.tmp 45 PID 2188 wrote to memory of 2652 2188 54E4.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-24_9fbfdcb94cc91418862a3cc5e69de1da_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\514B.tmp"C:\Users\Admin\AppData\Local\Temp\514B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\5226.tmp"C:\Users\Admin\AppData\Local\Temp\5226.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\54E4.tmp"C:\Users\Admin\AppData\Local\Temp\54E4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\559F.tmp"C:\Users\Admin\AppData\Local\Temp\559F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\565A.tmp"C:\Users\Admin\AppData\Local\Temp\565A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\56C7.tmp"C:\Users\Admin\AppData\Local\Temp\56C7.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5715.tmp"C:\Users\Admin\AppData\Local\Temp\5715.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\5763.tmp"C:\Users\Admin\AppData\Local\Temp\5763.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\57FF.tmp"C:\Users\Admin\AppData\Local\Temp\57FF.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\59A5.tmp"C:\Users\Admin\AppData\Local\Temp\59A5.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"C:\Users\Admin\AppData\Local\Temp\5AAE.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"C:\Users\Admin\AppData\Local\Temp\5AEC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"C:\Users\Admin\AppData\Local\Temp\5BB7.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"C:\Users\Admin\AppData\Local\Temp\5BF5.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"C:\Users\Admin\AppData\Local\Temp\5CC0.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"C:\Users\Admin\AppData\Local\Temp\5CFF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"C:\Users\Admin\AppData\Local\Temp\5D3D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\5E17.tmp"C:\Users\Admin\AppData\Local\Temp\5E17.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\5E56.tmp"C:\Users\Admin\AppData\Local\Temp\5E56.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5E94.tmp"C:\Users\Admin\AppData\Local\Temp\5E94.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"C:\Users\Admin\AppData\Local\Temp\5EE2.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5F21.tmp"C:\Users\Admin\AppData\Local\Temp\5F21.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"C:\Users\Admin\AppData\Local\Temp\5F5F.tmp"53⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"54⤵
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"C:\Users\Admin\AppData\Local\Temp\5FEB.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6049.tmp"C:\Users\Admin\AppData\Local\Temp\6049.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\60D5.tmp"C:\Users\Admin\AppData\Local\Temp\60D5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\6162.tmp"C:\Users\Admin\AppData\Local\Temp\6162.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\61A0.tmp"C:\Users\Admin\AppData\Local\Temp\61A0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\627B.tmp"C:\Users\Admin\AppData\Local\Temp\627B.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"66⤵
- Executes dropped EXE
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6336.tmp"C:\Users\Admin\AppData\Local\Temp\6336.tmp"67⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"68⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"69⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\6401.tmp"C:\Users\Admin\AppData\Local\Temp\6401.tmp"70⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\643F.tmp"C:\Users\Admin\AppData\Local\Temp\643F.tmp"71⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"72⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"73⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"74⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"75⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"76⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\65D5.tmp"C:\Users\Admin\AppData\Local\Temp\65D5.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"78⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"79⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6690.tmp"C:\Users\Admin\AppData\Local\Temp\6690.tmp"80⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\66CE.tmp"C:\Users\Admin\AppData\Local\Temp\66CE.tmp"81⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\670D.tmp"C:\Users\Admin\AppData\Local\Temp\670D.tmp"82⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"83⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\6789.tmp"C:\Users\Admin\AppData\Local\Temp\6789.tmp"84⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\67C8.tmp"C:\Users\Admin\AppData\Local\Temp\67C8.tmp"85⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6816.tmp"C:\Users\Admin\AppData\Local\Temp\6816.tmp"86⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\6854.tmp"C:\Users\Admin\AppData\Local\Temp\6854.tmp"87⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"88⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"89⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"90⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"92⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\6A09.tmp"C:\Users\Admin\AppData\Local\Temp\6A09.tmp"93⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6A47.tmp"C:\Users\Admin\AppData\Local\Temp\6A47.tmp"94⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"95⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"C:\Users\Admin\AppData\Local\Temp\6AE3.tmp"96⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6B22.tmp"C:\Users\Admin\AppData\Local\Temp\6B22.tmp"97⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"98⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"99⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\6BED.tmp"C:\Users\Admin\AppData\Local\Temp\6BED.tmp"100⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"101⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"102⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"103⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"C:\Users\Admin\AppData\Local\Temp\6CE6.tmp"104⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\6D25.tmp"C:\Users\Admin\AppData\Local\Temp\6D25.tmp"105⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\6D73.tmp"C:\Users\Admin\AppData\Local\Temp\6D73.tmp"106⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"107⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"108⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"109⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"110⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"111⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"112⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"113⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"114⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"115⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"116⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"117⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"118⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\70CD.tmp"C:\Users\Admin\AppData\Local\Temp\70CD.tmp"119⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\710B.tmp"C:\Users\Admin\AppData\Local\Temp\710B.tmp"120⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"121⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-