Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
02/08/2024, 09:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe
-
Size
486KB
-
MD5
946a1b4434b3117de3ee07039cde5139
-
SHA1
d5f1eda4d745a66df9d8c8c7936cd909438c251c
-
SHA256
a28150dcb461aef3e3c088b07b9cca5c5a894cf9e9cc6e6c471657a2cbd8c72b
-
SHA512
aed726e0e8f7b47d3e27403fdf07a945a83efe8ef4479e6a3da35033dd79561844f2feae51affd5f76e3b358f73ca1d9849a47c11bdf6fe614c99366c84d335a
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7qLAtQ9V6P6UI9XSdTPJiJTXQF5AGlecKKCbo:UU5rCOTeiDZ7y99CFPi7+nCbmNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2956 2202.tmp 2272 226F.tmp 2680 2397.tmp 2600 2472.tmp 2708 252D.tmp 2644 25E8.tmp 2736 2710.tmp 2764 27DB.tmp 2860 2877.tmp 1912 2980.tmp 2508 2A2C.tmp 2984 2B16.tmp 2108 2C10.tmp 1728 2CDA.tmp 2856 2DB5.tmp 2208 2EBE.tmp 1828 2F6A.tmp 828 3073.tmp 2080 315D.tmp 2780 3256.tmp 808 32E3.tmp 524 340B.tmp 1472 35B0.tmp 2912 362D.tmp 2312 36C9.tmp 2332 3765.tmp 2200 37F2.tmp 1856 389D.tmp 2296 390A.tmp 1308 3987.tmp 1216 3A23.tmp 1480 3AB0.tmp 952 3B3C.tmp 812 3BC8.tmp 3008 3C45.tmp 2792 3CA3.tmp 2492 3D20.tmp 1336 3DAC.tmp 1664 3E29.tmp 1932 3EB5.tmp 672 3F51.tmp 1468 3FDE.tmp 2052 406A.tmp 1484 40E7.tmp 2336 4164.tmp 2116 420F.tmp 1604 42AB.tmp 2164 4338.tmp 2424 43B4.tmp 2284 4450.tmp 2768 44DD.tmp 2224 4579.tmp 1588 45F6.tmp 2356 4682.tmp 2260 470E.tmp 1964 478B.tmp 2120 4808.tmp 3044 4885.tmp 2152 4902.tmp 2728 4AC6.tmp 2760 4BEE.tmp 2636 4C5C.tmp 2644 4CD8.tmp 2528 4D65.tmp -
Loads dropped DLL 64 IoCs
pid Process 2356 2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe 2956 2202.tmp 2272 226F.tmp 2680 2397.tmp 2600 2472.tmp 2708 252D.tmp 2644 25E8.tmp 2736 2710.tmp 2764 27DB.tmp 2860 2877.tmp 1912 2980.tmp 2508 2A2C.tmp 2984 2B16.tmp 2108 2C10.tmp 1728 2CDA.tmp 2856 2DB5.tmp 2208 2EBE.tmp 1828 2F6A.tmp 828 3073.tmp 2080 315D.tmp 2780 3256.tmp 808 32E3.tmp 524 340B.tmp 1472 35B0.tmp 2912 362D.tmp 2312 36C9.tmp 2332 3765.tmp 2200 37F2.tmp 1856 389D.tmp 2296 390A.tmp 1308 3987.tmp 1216 3A23.tmp 1480 3AB0.tmp 952 3B3C.tmp 812 3BC8.tmp 3008 3C45.tmp 2792 3CA3.tmp 2492 3D20.tmp 1336 3DAC.tmp 1664 3E29.tmp 1932 3EB5.tmp 672 3F51.tmp 1468 3FDE.tmp 2052 406A.tmp 1484 40E7.tmp 2336 4164.tmp 2116 420F.tmp 1604 42AB.tmp 2164 4338.tmp 2424 43B4.tmp 2284 4450.tmp 2768 44DD.tmp 2224 4579.tmp 1588 45F6.tmp 2356 4682.tmp 2260 470E.tmp 1964 478B.tmp 2120 4808.tmp 3044 4885.tmp 2152 4902.tmp 2728 4AC6.tmp 2760 4BEE.tmp 2636 4C5C.tmp 2644 4CD8.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C88D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDDF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E225.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 514B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8112.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B05B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 63A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89C9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C043.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9463.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9869.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 43A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7964.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D614.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E408.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E61B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6558.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E234.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ADBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F769.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A766.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F844.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4FE5.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2956 2356 2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe 30 PID 2356 wrote to memory of 2956 2356 2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe 30 PID 2356 wrote to memory of 2956 2356 2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe 30 PID 2356 wrote to memory of 2956 2356 2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe 30 PID 2956 wrote to memory of 2272 2956 2202.tmp 31 PID 2956 wrote to memory of 2272 2956 2202.tmp 31 PID 2956 wrote to memory of 2272 2956 2202.tmp 31 PID 2956 wrote to memory of 2272 2956 2202.tmp 31 PID 2272 wrote to memory of 2680 2272 226F.tmp 32 PID 2272 wrote to memory of 2680 2272 226F.tmp 32 PID 2272 wrote to memory of 2680 2272 226F.tmp 32 PID 2272 wrote to memory of 2680 2272 226F.tmp 32 PID 2680 wrote to memory of 2600 2680 2397.tmp 33 PID 2680 wrote to memory of 2600 2680 2397.tmp 33 PID 2680 wrote to memory of 2600 2680 2397.tmp 33 PID 2680 wrote to memory of 2600 2680 2397.tmp 33 PID 2600 wrote to memory of 2708 2600 2472.tmp 34 PID 2600 wrote to memory of 2708 2600 2472.tmp 34 PID 2600 wrote to memory of 2708 2600 2472.tmp 34 PID 2600 wrote to memory of 2708 2600 2472.tmp 34 PID 2708 wrote to memory of 2644 2708 252D.tmp 35 PID 2708 wrote to memory of 2644 2708 252D.tmp 35 PID 2708 wrote to memory of 2644 2708 252D.tmp 35 PID 2708 wrote to memory of 2644 2708 252D.tmp 35 PID 2644 wrote to memory of 2736 2644 25E8.tmp 36 PID 2644 wrote to memory of 2736 2644 25E8.tmp 36 PID 2644 wrote to memory of 2736 2644 25E8.tmp 36 PID 2644 wrote to memory of 2736 2644 25E8.tmp 36 PID 2736 wrote to memory of 2764 2736 2710.tmp 37 PID 2736 wrote to memory of 2764 2736 2710.tmp 37 PID 2736 wrote to memory of 2764 2736 2710.tmp 37 PID 2736 wrote to memory of 2764 2736 2710.tmp 37 PID 2764 wrote to memory of 2860 2764 27DB.tmp 38 PID 2764 wrote to memory of 2860 2764 27DB.tmp 38 PID 2764 wrote to memory of 2860 2764 27DB.tmp 38 PID 2764 wrote to memory of 2860 2764 27DB.tmp 38 PID 2860 wrote to memory of 1912 2860 2877.tmp 39 PID 2860 wrote to memory of 1912 2860 2877.tmp 39 PID 2860 wrote to memory of 1912 2860 2877.tmp 39 PID 2860 wrote to memory of 1912 2860 2877.tmp 39 PID 1912 wrote to memory of 2508 1912 2980.tmp 40 PID 1912 wrote to memory of 2508 1912 2980.tmp 40 PID 1912 wrote to memory of 2508 1912 2980.tmp 40 PID 1912 wrote to memory of 2508 1912 2980.tmp 40 PID 2508 wrote to memory of 2984 2508 2A2C.tmp 41 PID 2508 wrote to memory of 2984 2508 2A2C.tmp 41 PID 2508 wrote to memory of 2984 2508 2A2C.tmp 41 PID 2508 wrote to memory of 2984 2508 2A2C.tmp 41 PID 2984 wrote to memory of 2108 2984 2B16.tmp 42 PID 2984 wrote to memory of 2108 2984 2B16.tmp 42 PID 2984 wrote to memory of 2108 2984 2B16.tmp 42 PID 2984 wrote to memory of 2108 2984 2B16.tmp 42 PID 2108 wrote to memory of 1728 2108 2C10.tmp 43 PID 2108 wrote to memory of 1728 2108 2C10.tmp 43 PID 2108 wrote to memory of 1728 2108 2C10.tmp 43 PID 2108 wrote to memory of 1728 2108 2C10.tmp 43 PID 1728 wrote to memory of 2856 1728 2CDA.tmp 44 PID 1728 wrote to memory of 2856 1728 2CDA.tmp 44 PID 1728 wrote to memory of 2856 1728 2CDA.tmp 44 PID 1728 wrote to memory of 2856 1728 2CDA.tmp 44 PID 2856 wrote to memory of 2208 2856 2DB5.tmp 45 PID 2856 wrote to memory of 2208 2856 2DB5.tmp 45 PID 2856 wrote to memory of 2208 2856 2DB5.tmp 45 PID 2856 wrote to memory of 2208 2856 2DB5.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_946a1b4434b3117de3ee07039cde5139_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2202.tmp"C:\Users\Admin\AppData\Local\Temp\2202.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\2397.tmp"C:\Users\Admin\AppData\Local\Temp\2397.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2472.tmp"C:\Users\Admin\AppData\Local\Temp\2472.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\27DB.tmp"C:\Users\Admin\AppData\Local\Temp\27DB.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"C:\Users\Admin\AppData\Local\Temp\2A2C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"C:\Users\Admin\AppData\Local\Temp\2DB5.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\3073.tmp"C:\Users\Admin\AppData\Local\Temp\3073.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:524 -
C:\Users\Admin\AppData\Local\Temp\35B0.tmp"C:\Users\Admin\AppData\Local\Temp\35B0.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\36C9.tmp"C:\Users\Admin\AppData\Local\Temp\36C9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\390A.tmp"C:\Users\Admin\AppData\Local\Temp\390A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"C:\Users\Admin\AppData\Local\Temp\3DAC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:672 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\406A.tmp"C:\Users\Admin\AppData\Local\Temp\406A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4450.tmp"C:\Users\Admin\AppData\Local\Temp\4450.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\45F6.tmp"C:\Users\Admin\AppData\Local\Temp\45F6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\4682.tmp"C:\Users\Admin\AppData\Local\Temp\4682.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\470E.tmp"C:\Users\Admin\AppData\Local\Temp\470E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\478B.tmp"C:\Users\Admin\AppData\Local\Temp\478B.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\4885.tmp"C:\Users\Admin\AppData\Local\Temp\4885.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\4902.tmp"C:\Users\Admin\AppData\Local\Temp\4902.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"C:\Users\Admin\AppData\Local\Temp\4AC6.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"65⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"66⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"67⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\4F77.tmp"C:\Users\Admin\AppData\Local\Temp\4F77.tmp"69⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"70⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"71⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\50DE.tmp"C:\Users\Admin\AppData\Local\Temp\50DE.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\515B.tmp"C:\Users\Admin\AppData\Local\Temp\515B.tmp"73⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"74⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\5264.tmp"C:\Users\Admin\AppData\Local\Temp\5264.tmp"75⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\52E1.tmp"C:\Users\Admin\AppData\Local\Temp\52E1.tmp"76⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\534E.tmp"C:\Users\Admin\AppData\Local\Temp\534E.tmp"77⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\53BB.tmp"C:\Users\Admin\AppData\Local\Temp\53BB.tmp"78⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5419.tmp"C:\Users\Admin\AppData\Local\Temp\5419.tmp"79⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\54A5.tmp"C:\Users\Admin\AppData\Local\Temp\54A5.tmp"80⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"81⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\558F.tmp"C:\Users\Admin\AppData\Local\Temp\558F.tmp"82⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\560C.tmp"C:\Users\Admin\AppData\Local\Temp\560C.tmp"83⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\5689.tmp"C:\Users\Admin\AppData\Local\Temp\5689.tmp"84⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5706.tmp"C:\Users\Admin\AppData\Local\Temp\5706.tmp"85⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5783.tmp"C:\Users\Admin\AppData\Local\Temp\5783.tmp"86⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"87⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\587C.tmp"C:\Users\Admin\AppData\Local\Temp\587C.tmp"88⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\58F9.tmp"C:\Users\Admin\AppData\Local\Temp\58F9.tmp"89⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"90⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"91⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"92⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"93⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\5B79.tmp"C:\Users\Admin\AppData\Local\Temp\5B79.tmp"94⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"95⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\5C63.tmp"C:\Users\Admin\AppData\Local\Temp\5C63.tmp"96⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"97⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"98⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"99⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"100⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"C:\Users\Admin\AppData\Local\Temp\5EA4.tmp"101⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\5F21.tmp"C:\Users\Admin\AppData\Local\Temp\5F21.tmp"102⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\6087.tmp"C:\Users\Admin\AppData\Local\Temp\6087.tmp"103⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\60F5.tmp"C:\Users\Admin\AppData\Local\Temp\60F5.tmp"104⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"105⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\621D.tmp"C:\Users\Admin\AppData\Local\Temp\621D.tmp"106⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\629A.tmp"C:\Users\Admin\AppData\Local\Temp\629A.tmp"107⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"108⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\63D2.tmp"C:\Users\Admin\AppData\Local\Temp\63D2.tmp"109⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"110⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"112⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\65A6.tmp"C:\Users\Admin\AppData\Local\Temp\65A6.tmp"113⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\6642.tmp"C:\Users\Admin\AppData\Local\Temp\6642.tmp"114⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\66AF.tmp"C:\Users\Admin\AppData\Local\Temp\66AF.tmp"115⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"116⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"117⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"118⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"119⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"120⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"121⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\6A38.tmp"C:\Users\Admin\AppData\Local\Temp\6A38.tmp"122⤵PID:2120
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-