Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 03:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe
-
Size
536KB
-
MD5
177b7a9acf5af7340c640bcea8ad1f0c
-
SHA1
ed42093b3da872a6315a3700e2932700a9ac1c0c
-
SHA256
baeb15d48d0dd22deedd58930431a71e89b2e6516cbfeee39903a402d83a7720
-
SHA512
77e24aca4db0211f1139e031e7875305a5784254d991438a1c1c76ef7b7cb280a05378256d1c70c9ed7b171778b407a37110c2dddd1591171689fd1badf9de4e
-
SSDEEP
12288:wU5rCOTeiUltG4LXbyYGwkscssghVtIZxVJ0ZT9:wUQOJUltGSDTsg1IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1972 94A1.tmp 1912 94FF.tmp 3040 955D.tmp 2248 95CA.tmp 2908 9618.tmp 2760 9666.tmp 2796 96C3.tmp 2356 9711.tmp 2636 975F.tmp 1408 97AD.tmp 2112 97FB.tmp 1928 9859.tmp 2732 98A7.tmp 2816 98F5.tmp 2876 9953.tmp 3024 99A1.tmp 2880 99EF.tmp 316 9A3D.tmp 2436 9AB9.tmp 1788 9B17.tmp 584 9B75.tmp 1696 9BD2.tmp 1488 9C20.tmp 1136 9C5F.tmp 2096 9CBC.tmp 2044 9D1A.tmp 1856 9D68.tmp 1544 9DB6.tmp 1744 9E04.tmp 2208 9E52.tmp 1796 9EA0.tmp 2488 9EEE.tmp 2416 9F3C.tmp 1536 9F99.tmp 2844 9FD8.tmp 1752 A016.tmp 344 A064.tmp 2364 A0B2.tmp 2156 A0F1.tmp 1592 A12F.tmp 1692 A16D.tmp 2396 A1BB.tmp 2776 A1FA.tmp 2968 A238.tmp 2116 A303.tmp 3064 A370.tmp 2900 A3BE.tmp 3060 A43B.tmp 284 A489.tmp 1060 A535.tmp 2684 A583.tmp 2688 A5D1.tmp 1660 A62E.tmp 2872 A68C.tmp 1904 A6DA.tmp 1104 A728.tmp 1048 A766.tmp 908 A7B4.tmp 2888 A831.tmp 3012 A87F.tmp 1324 A8CD.tmp 1612 A90B.tmp 2412 A94A.tmp 924 A988.tmp -
Loads dropped DLL 64 IoCs
pid Process 1712 2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe 1972 94A1.tmp 1912 94FF.tmp 3040 955D.tmp 2248 95CA.tmp 2908 9618.tmp 2760 9666.tmp 2796 96C3.tmp 2356 9711.tmp 2636 975F.tmp 1408 97AD.tmp 2112 97FB.tmp 1928 9859.tmp 2732 98A7.tmp 2816 98F5.tmp 2876 9953.tmp 3024 99A1.tmp 2880 99EF.tmp 316 9A3D.tmp 2436 9AB9.tmp 1788 9B17.tmp 584 9B75.tmp 1696 9BD2.tmp 1488 9C20.tmp 1136 9C5F.tmp 2096 9CBC.tmp 2044 9D1A.tmp 1856 9D68.tmp 1544 9DB6.tmp 1744 9E04.tmp 2208 9E52.tmp 1796 9EA0.tmp 2488 9EEE.tmp 2416 9F3C.tmp 1536 9F99.tmp 2844 9FD8.tmp 1752 A016.tmp 344 A064.tmp 2364 A0B2.tmp 2156 A0F1.tmp 1592 A12F.tmp 1692 A16D.tmp 2396 A1BB.tmp 2776 A1FA.tmp 2968 A238.tmp 2116 A303.tmp 3064 A370.tmp 2900 A3BE.tmp 3060 A43B.tmp 284 A489.tmp 1060 A535.tmp 2684 A583.tmp 2688 A5D1.tmp 1660 A62E.tmp 2872 A68C.tmp 1904 A6DA.tmp 1104 A728.tmp 1048 A766.tmp 908 A7B4.tmp 2888 A831.tmp 3012 A87F.tmp 1324 A8CD.tmp 1612 A90B.tmp 2412 A94A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 401C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4173.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EACC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4470.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7790.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72EF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C67.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C053.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6873.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1972 1712 2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe 30 PID 1712 wrote to memory of 1972 1712 2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe 30 PID 1712 wrote to memory of 1972 1712 2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe 30 PID 1712 wrote to memory of 1972 1712 2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe 30 PID 1972 wrote to memory of 1912 1972 94A1.tmp 31 PID 1972 wrote to memory of 1912 1972 94A1.tmp 31 PID 1972 wrote to memory of 1912 1972 94A1.tmp 31 PID 1972 wrote to memory of 1912 1972 94A1.tmp 31 PID 1912 wrote to memory of 3040 1912 94FF.tmp 32 PID 1912 wrote to memory of 3040 1912 94FF.tmp 32 PID 1912 wrote to memory of 3040 1912 94FF.tmp 32 PID 1912 wrote to memory of 3040 1912 94FF.tmp 32 PID 3040 wrote to memory of 2248 3040 955D.tmp 33 PID 3040 wrote to memory of 2248 3040 955D.tmp 33 PID 3040 wrote to memory of 2248 3040 955D.tmp 33 PID 3040 wrote to memory of 2248 3040 955D.tmp 33 PID 2248 wrote to memory of 2908 2248 95CA.tmp 34 PID 2248 wrote to memory of 2908 2248 95CA.tmp 34 PID 2248 wrote to memory of 2908 2248 95CA.tmp 34 PID 2248 wrote to memory of 2908 2248 95CA.tmp 34 PID 2908 wrote to memory of 2760 2908 9618.tmp 35 PID 2908 wrote to memory of 2760 2908 9618.tmp 35 PID 2908 wrote to memory of 2760 2908 9618.tmp 35 PID 2908 wrote to memory of 2760 2908 9618.tmp 35 PID 2760 wrote to memory of 2796 2760 9666.tmp 36 PID 2760 wrote to memory of 2796 2760 9666.tmp 36 PID 2760 wrote to memory of 2796 2760 9666.tmp 36 PID 2760 wrote to memory of 2796 2760 9666.tmp 36 PID 2796 wrote to memory of 2356 2796 96C3.tmp 37 PID 2796 wrote to memory of 2356 2796 96C3.tmp 37 PID 2796 wrote to memory of 2356 2796 96C3.tmp 37 PID 2796 wrote to memory of 2356 2796 96C3.tmp 37 PID 2356 wrote to memory of 2636 2356 9711.tmp 38 PID 2356 wrote to memory of 2636 2356 9711.tmp 38 PID 2356 wrote to memory of 2636 2356 9711.tmp 38 PID 2356 wrote to memory of 2636 2356 9711.tmp 38 PID 2636 wrote to memory of 1408 2636 975F.tmp 39 PID 2636 wrote to memory of 1408 2636 975F.tmp 39 PID 2636 wrote to memory of 1408 2636 975F.tmp 39 PID 2636 wrote to memory of 1408 2636 975F.tmp 39 PID 1408 wrote to memory of 2112 1408 97AD.tmp 40 PID 1408 wrote to memory of 2112 1408 97AD.tmp 40 PID 1408 wrote to memory of 2112 1408 97AD.tmp 40 PID 1408 wrote to memory of 2112 1408 97AD.tmp 40 PID 2112 wrote to memory of 1928 2112 97FB.tmp 41 PID 2112 wrote to memory of 1928 2112 97FB.tmp 41 PID 2112 wrote to memory of 1928 2112 97FB.tmp 41 PID 2112 wrote to memory of 1928 2112 97FB.tmp 41 PID 1928 wrote to memory of 2732 1928 9859.tmp 42 PID 1928 wrote to memory of 2732 1928 9859.tmp 42 PID 1928 wrote to memory of 2732 1928 9859.tmp 42 PID 1928 wrote to memory of 2732 1928 9859.tmp 42 PID 2732 wrote to memory of 2816 2732 98A7.tmp 43 PID 2732 wrote to memory of 2816 2732 98A7.tmp 43 PID 2732 wrote to memory of 2816 2732 98A7.tmp 43 PID 2732 wrote to memory of 2816 2732 98A7.tmp 43 PID 2816 wrote to memory of 2876 2816 98F5.tmp 44 PID 2816 wrote to memory of 2876 2816 98F5.tmp 44 PID 2816 wrote to memory of 2876 2816 98F5.tmp 44 PID 2816 wrote to memory of 2876 2816 98F5.tmp 44 PID 2876 wrote to memory of 3024 2876 9953.tmp 45 PID 2876 wrote to memory of 3024 2876 9953.tmp 45 PID 2876 wrote to memory of 3024 2876 9953.tmp 45 PID 2876 wrote to memory of 3024 2876 9953.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_177b7a9acf5af7340c640bcea8ad1f0c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\96C3.tmp"C:\Users\Admin\AppData\Local\Temp\96C3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\9711.tmp"C:\Users\Admin\AppData\Local\Temp\9711.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\97FB.tmp"C:\Users\Admin\AppData\Local\Temp\97FB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\98A7.tmp"C:\Users\Admin\AppData\Local\Temp\98A7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\98F5.tmp"C:\Users\Admin\AppData\Local\Temp\98F5.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"C:\Users\Admin\AppData\Local\Temp\9CBC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"C:\Users\Admin\AppData\Local\Temp\9EA0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"C:\Users\Admin\AppData\Local\Temp\9F3C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\A064.tmp"C:\Users\Admin\AppData\Local\Temp\A064.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"C:\Users\Admin\AppData\Local\Temp\A1BB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"C:\Users\Admin\AppData\Local\Temp\A1FA.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"C:\Users\Admin\AppData\Local\Temp\A6DA.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"C:\Users\Admin\AppData\Local\Temp\A8CD.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"65⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"66⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"67⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"68⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"69⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"70⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"C:\Users\Admin\AppData\Local\Temp\AB3D.tmp"71⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"72⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"73⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"74⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"75⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"76⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\AD01.tmp"C:\Users\Admin\AppData\Local\Temp\AD01.tmp"77⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"78⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"79⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"80⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"81⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"82⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"83⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"84⤵
- System Location Discovery: System Language Discovery
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"85⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"86⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"C:\Users\Admin\AppData\Local\Temp\AFDF.tmp"87⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"88⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"89⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"91⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"92⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"93⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"94⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"95⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"96⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"97⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"C:\Users\Admin\AppData\Local\Temp\B2CB.tmp"98⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"99⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"100⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"101⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"102⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"103⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"104⤵PID:800
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"105⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"106⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"107⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"108⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"110⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"111⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"112⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"113⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"114⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"115⤵PID:348
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"116⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"117⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"118⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"119⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"120⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"121⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-