Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
05/08/2024, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe
-
Size
488KB
-
MD5
c7755447cc5566f762abfef0abf0c737
-
SHA1
6d3c89a4c84c50390705cb0d0115b78285cd03b0
-
SHA256
686b121b4da5223f21a9e36e996c5bd45c679bda9d3847a05d83429f93fdcd92
-
SHA512
5e811bbd9899d052272b84c1dfb1190c251f75d67e6364056ff2fb887838f6231f256744efa7a47fc2aaf6e74302625efb460ee78ba44add0b9cda57999e9e15
-
SSDEEP
12288:/U5rCOTeiDeCwT9/HqQ2th+ktc09Atqi3WNZ:/UQOJDj+N32F9Bi3WN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2820 5995.tmp 2688 5A31.tmp 2592 5B2B.tmp 2620 5C05.tmp 2624 5CD0.tmp 2784 5D9B.tmp 2616 5E75.tmp 3060 5F7E.tmp 3044 6039.tmp 2684 6123.tmp 1968 620D.tmp 1988 62D8.tmp 2964 6374.tmp 2268 644F.tmp 2108 650A.tmp 1340 6587.tmp 2908 6680.tmp 588 674B.tmp 2512 67E7.tmp 1196 68A2.tmp 1092 696D.tmp 544 6A28.tmp 520 6A95.tmp 2248 6B70.tmp 2072 6C69.tmp 2196 6CD7.tmp 2960 6D53.tmp 2492 6DC1.tmp 2312 6E3D.tmp 2300 6EAB.tmp 1156 6F18.tmp 1812 6F95.tmp 1792 6FF2.tmp 884 706F.tmp 1856 70DC.tmp 1008 7159.tmp 980 71D6.tmp 1520 7243.tmp 744 72DF.tmp 1388 734C.tmp 1736 73B9.tmp 2664 7436.tmp 3068 74A3.tmp 1064 7520.tmp 2528 757E.tmp 2996 75EB.tmp 1392 7668.tmp 3020 7704.tmp 1128 7781.tmp 1664 780D.tmp 864 787A.tmp 2464 78F7.tmp 1708 7A10.tmp 2736 7A7D.tmp 2708 7AEA.tmp 2688 7B67.tmp 2744 7BD4.tmp 2904 7C61.tmp 1908 7CDD.tmp 2696 7D6A.tmp 1072 7DE7.tmp 2596 7E63.tmp 3032 7EC1.tmp 2636 7F2E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2728 2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe 2820 5995.tmp 2688 5A31.tmp 2592 5B2B.tmp 2620 5C05.tmp 2624 5CD0.tmp 2784 5D9B.tmp 2616 5E75.tmp 3060 5F7E.tmp 3044 6039.tmp 2684 6123.tmp 1968 620D.tmp 1988 62D8.tmp 2964 6374.tmp 2268 644F.tmp 2108 650A.tmp 1340 6587.tmp 2908 6680.tmp 588 674B.tmp 2512 67E7.tmp 1196 68A2.tmp 1092 696D.tmp 544 6A28.tmp 520 6A95.tmp 2248 6B70.tmp 2072 6C69.tmp 2196 6CD7.tmp 2960 6D53.tmp 2492 6DC1.tmp 2312 6E3D.tmp 2300 6EAB.tmp 1156 6F18.tmp 1812 6F95.tmp 1792 6FF2.tmp 884 706F.tmp 1856 70DC.tmp 1008 7159.tmp 980 71D6.tmp 1520 7243.tmp 744 72DF.tmp 1388 734C.tmp 1736 73B9.tmp 2664 7436.tmp 3068 74A3.tmp 1064 7520.tmp 2528 757E.tmp 2996 75EB.tmp 1392 7668.tmp 3020 7704.tmp 1128 7781.tmp 1664 780D.tmp 864 787A.tmp 1572 7955.tmp 1708 7A10.tmp 2736 7A7D.tmp 2708 7AEA.tmp 2688 7B67.tmp 2744 7BD4.tmp 2904 7C61.tmp 1908 7CDD.tmp 2696 7D6A.tmp 1072 7DE7.tmp 2596 7E63.tmp 3032 7EC1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D337.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7243.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 209B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DF1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 278D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6374.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B461.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 980B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E245.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 864F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E33E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3228.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9981.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CAC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 674B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D163.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8298.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AA3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F844.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5918.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 399.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A489.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C4C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2626.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C5A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2820 2728 2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe 30 PID 2728 wrote to memory of 2820 2728 2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe 30 PID 2820 wrote to memory of 2688 2820 5995.tmp 31 PID 2820 wrote to memory of 2688 2820 5995.tmp 31 PID 2820 wrote to memory of 2688 2820 5995.tmp 31 PID 2820 wrote to memory of 2688 2820 5995.tmp 31 PID 2688 wrote to memory of 2592 2688 5A31.tmp 32 PID 2688 wrote to memory of 2592 2688 5A31.tmp 32 PID 2688 wrote to memory of 2592 2688 5A31.tmp 32 PID 2688 wrote to memory of 2592 2688 5A31.tmp 32 PID 2592 wrote to memory of 2620 2592 5B2B.tmp 33 PID 2592 wrote to memory of 2620 2592 5B2B.tmp 33 PID 2592 wrote to memory of 2620 2592 5B2B.tmp 33 PID 2592 wrote to memory of 2620 2592 5B2B.tmp 33 PID 2620 wrote to memory of 2624 2620 5C05.tmp 34 PID 2620 wrote to memory of 2624 2620 5C05.tmp 34 PID 2620 wrote to memory of 2624 2620 5C05.tmp 34 PID 2620 wrote to memory of 2624 2620 5C05.tmp 34 PID 2624 wrote to memory of 2784 2624 5CD0.tmp 35 PID 2624 wrote to memory of 2784 2624 5CD0.tmp 35 PID 2624 wrote to memory of 2784 2624 5CD0.tmp 35 PID 2624 wrote to memory of 2784 2624 5CD0.tmp 35 PID 2784 wrote to memory of 2616 2784 5D9B.tmp 36 PID 2784 wrote to memory of 2616 2784 5D9B.tmp 36 PID 2784 wrote to memory of 2616 2784 5D9B.tmp 36 PID 2784 wrote to memory of 2616 2784 5D9B.tmp 36 PID 2616 wrote to memory of 3060 2616 5E75.tmp 37 PID 2616 wrote to memory of 3060 2616 5E75.tmp 37 PID 2616 wrote to memory of 3060 2616 5E75.tmp 37 PID 2616 wrote to memory of 3060 2616 5E75.tmp 37 PID 3060 wrote to memory of 3044 3060 5F7E.tmp 38 PID 3060 wrote to memory of 3044 3060 5F7E.tmp 38 PID 3060 wrote to memory of 3044 3060 5F7E.tmp 38 PID 3060 wrote to memory of 3044 3060 5F7E.tmp 38 PID 3044 wrote to memory of 2684 3044 6039.tmp 39 PID 3044 wrote to memory of 2684 3044 6039.tmp 39 PID 3044 wrote to memory of 2684 3044 6039.tmp 39 PID 3044 wrote to memory of 2684 3044 6039.tmp 39 PID 2684 wrote to memory of 1968 2684 6123.tmp 40 PID 2684 wrote to memory of 1968 2684 6123.tmp 40 PID 2684 wrote to memory of 1968 2684 6123.tmp 40 PID 2684 wrote to memory of 1968 2684 6123.tmp 40 PID 1968 wrote to memory of 1988 1968 620D.tmp 41 PID 1968 wrote to memory of 1988 1968 620D.tmp 41 PID 1968 wrote to memory of 1988 1968 620D.tmp 41 PID 1968 wrote to memory of 1988 1968 620D.tmp 41 PID 1988 wrote to memory of 2964 1988 62D8.tmp 42 PID 1988 wrote to memory of 2964 1988 62D8.tmp 42 PID 1988 wrote to memory of 2964 1988 62D8.tmp 42 PID 1988 wrote to memory of 2964 1988 62D8.tmp 42 PID 2964 wrote to memory of 2268 2964 6374.tmp 43 PID 2964 wrote to memory of 2268 2964 6374.tmp 43 PID 2964 wrote to memory of 2268 2964 6374.tmp 43 PID 2964 wrote to memory of 2268 2964 6374.tmp 43 PID 2268 wrote to memory of 2108 2268 644F.tmp 44 PID 2268 wrote to memory of 2108 2268 644F.tmp 44 PID 2268 wrote to memory of 2108 2268 644F.tmp 44 PID 2268 wrote to memory of 2108 2268 644F.tmp 44 PID 2108 wrote to memory of 1340 2108 650A.tmp 45 PID 2108 wrote to memory of 1340 2108 650A.tmp 45 PID 2108 wrote to memory of 1340 2108 650A.tmp 45 PID 2108 wrote to memory of 1340 2108 650A.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-05_c7755447cc5566f762abfef0abf0c737_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"C:\Users\Admin\AppData\Local\Temp\5B2B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"C:\Users\Admin\AppData\Local\Temp\5D9B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\6123.tmp"C:\Users\Admin\AppData\Local\Temp\6123.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\620D.tmp"C:\Users\Admin\AppData\Local\Temp\620D.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\62D8.tmp"C:\Users\Admin\AppData\Local\Temp\62D8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\6374.tmp"C:\Users\Admin\AppData\Local\Temp\6374.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\650A.tmp"C:\Users\Admin\AppData\Local\Temp\650A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:588 -
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\696D.tmp"C:\Users\Admin\AppData\Local\Temp\696D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\6A28.tmp"C:\Users\Admin\AppData\Local\Temp\6A28.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520 -
C:\Users\Admin\AppData\Local\Temp\6B70.tmp"C:\Users\Admin\AppData\Local\Temp\6B70.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\6C69.tmp"C:\Users\Admin\AppData\Local\Temp\6C69.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"C:\Users\Admin\AppData\Local\Temp\6CD7.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\6D53.tmp"C:\Users\Admin\AppData\Local\Temp\6D53.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\6F18.tmp"C:\Users\Admin\AppData\Local\Temp\6F18.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\7159.tmp"C:\Users\Admin\AppData\Local\Temp\7159.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\71D6.tmp"C:\Users\Admin\AppData\Local\Temp\71D6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7243.tmp"C:\Users\Admin\AppData\Local\Temp\7243.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\72DF.tmp"C:\Users\Admin\AppData\Local\Temp\72DF.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:744 -
C:\Users\Admin\AppData\Local\Temp\734C.tmp"C:\Users\Admin\AppData\Local\Temp\734C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7781.tmp"C:\Users\Admin\AppData\Local\Temp\7781.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"53⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"54⤵
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\7A10.tmp"C:\Users\Admin\AppData\Local\Temp\7A10.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"C:\Users\Admin\AppData\Local\Temp\7CDD.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"C:\Users\Admin\AppData\Local\Temp\7DE7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"C:\Users\Admin\AppData\Local\Temp\7F2E.tmp"66⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"67⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"C:\Users\Admin\AppData\Local\Temp\7FF9.tmp"68⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"69⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\81BD.tmp"C:\Users\Admin\AppData\Local\Temp\81BD.tmp"70⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"71⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\82B7.tmp"C:\Users\Admin\AppData\Local\Temp\82B7.tmp"72⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\8324.tmp"C:\Users\Admin\AppData\Local\Temp\8324.tmp"73⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\842D.tmp"C:\Users\Admin\AppData\Local\Temp\842D.tmp"75⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\84C9.tmp"C:\Users\Admin\AppData\Local\Temp\84C9.tmp"76⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"77⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"78⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\864F.tmp"C:\Users\Admin\AppData\Local\Temp\864F.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\86DC.tmp"C:\Users\Admin\AppData\Local\Temp\86DC.tmp"80⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\8759.tmp"C:\Users\Admin\AppData\Local\Temp\8759.tmp"81⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"82⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"83⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"84⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"85⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"86⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\8A45.tmp"C:\Users\Admin\AppData\Local\Temp\8A45.tmp"87⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"88⤵
- System Location Discovery: System Language Discovery
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"89⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"90⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"91⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"C:\Users\Admin\AppData\Local\Temp\8CA6.tmp"92⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"93⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"C:\Users\Admin\AppData\Local\Temp\8D9F.tmp"94⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"C:\Users\Admin\AppData\Local\Temp\8E1C.tmp"95⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"96⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"97⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\8F54.tmp"C:\Users\Admin\AppData\Local\Temp\8F54.tmp"98⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"100⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\90EA.tmp"C:\Users\Admin\AppData\Local\Temp\90EA.tmp"101⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\9167.tmp"C:\Users\Admin\AppData\Local\Temp\9167.tmp"102⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"103⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9251.tmp"C:\Users\Admin\AppData\Local\Temp\9251.tmp"104⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"105⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\932B.tmp"C:\Users\Admin\AppData\Local\Temp\932B.tmp"106⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"107⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"108⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"109⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"110⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"111⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"112⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"113⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\9849.tmp"C:\Users\Admin\AppData\Local\Temp\9849.tmp"114⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"115⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"116⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"117⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"118⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"119⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"120⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"121⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"C:\Users\Admin\AppData\Local\Temp\9BF1.tmp"122⤵PID:2848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-