Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 01:40
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe
-
Size
765KB
-
MD5
6cbfe490f328aeb2a45210c766385e77
-
SHA1
ff84e5551e54abb016695fad78f9f63de6cc2b9a
-
SHA256
93732807b49adfab573256782c284c946e0352cfd120cf2db7ff72786639cd12
-
SHA512
19d7f9ea105b0b13120b31566927833b8a179d5f7720f784c8121a1a5c94a2ce6130f13b46d7827bd3fc26912af38049b665fc9184c6b52a92d8ded2deae703a
-
SSDEEP
12288:ZU5rCOTeiDiXDFy7pnORuj95EHYQpI3ZF5rn5rLOa54U5w5A:ZUQOJD+DgdyuZCHYQpI3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2436 9869.tmp 2096 98B7.tmp 2348 9943.tmp 2744 99C0.tmp 2892 9A4C.tmp 2624 9AC9.tmp 2908 9B46.tmp 2640 9BB3.tmp 2672 9C20.tmp 2632 9C9D.tmp 2784 9D1A.tmp 2252 9DA6.tmp 276 9E04.tmp 1476 9E71.tmp 2716 9EEE.tmp 388 9F6B.tmp 576 9FE7.tmp 832 A074.tmp 2684 A0F1.tmp 1120 A16D.tmp 280 A1CB.tmp 2032 A248.tmp 612 A2B5.tmp 2972 A2F3.tmp 2036 A332.tmp 1988 A370.tmp 2596 A3AF.tmp 2372 A3ED.tmp 1144 A43B.tmp 1600 A479.tmp 448 A4B8.tmp 764 A4F6.tmp 1180 A535.tmp 1352 A573.tmp 2220 A5B1.tmp 1376 A5F0.tmp 2256 A62E.tmp 1760 A66D.tmp 1788 A6AB.tmp 1932 A6E9.tmp 664 A728.tmp 2460 A766.tmp 2156 A7A5.tmp 756 A7E3.tmp 976 A821.tmp 3044 A860.tmp 2504 A89E.tmp 2344 A8DD.tmp 2008 A91B.tmp 2584 A959.tmp 3052 A998.tmp 1564 A9D6.tmp 1588 AA24.tmp 2080 AA63.tmp 2488 AAA1.tmp 2060 AADF.tmp 2760 AB1E.tmp 2756 AB5C.tmp 2744 ABC9.tmp 3004 AC08.tmp 2892 AC46.tmp 2624 AC94.tmp 2792 ACD3.tmp 2780 AD11.tmp -
Loads dropped DLL 64 IoCs
pid Process 1696 2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe 2436 9869.tmp 2096 98B7.tmp 2348 9943.tmp 2744 99C0.tmp 2892 9A4C.tmp 2624 9AC9.tmp 2908 9B46.tmp 2640 9BB3.tmp 2672 9C20.tmp 2632 9C9D.tmp 2784 9D1A.tmp 2252 9DA6.tmp 276 9E04.tmp 1476 9E71.tmp 2716 9EEE.tmp 388 9F6B.tmp 576 9FE7.tmp 832 A074.tmp 2684 A0F1.tmp 1120 A16D.tmp 280 A1CB.tmp 2032 A248.tmp 612 A2B5.tmp 2972 A2F3.tmp 2036 A332.tmp 1988 A370.tmp 2596 A3AF.tmp 2372 A3ED.tmp 1144 A43B.tmp 1600 A479.tmp 448 A4B8.tmp 764 A4F6.tmp 1180 A535.tmp 1352 A573.tmp 2220 A5B1.tmp 1376 A5F0.tmp 2256 A62E.tmp 1760 A66D.tmp 1788 A6AB.tmp 1932 A6E9.tmp 664 A728.tmp 2460 A766.tmp 2156 A7A5.tmp 756 A7E3.tmp 976 A821.tmp 3044 A860.tmp 2504 A89E.tmp 2344 A8DD.tmp 2008 A91B.tmp 2584 A959.tmp 3052 A998.tmp 1564 A9D6.tmp 1588 AA24.tmp 2080 AA63.tmp 2488 AAA1.tmp 2060 AADF.tmp 2760 AB1E.tmp 2756 AB5C.tmp 2744 ABC9.tmp 3004 AC08.tmp 2892 AC46.tmp 2624 AC94.tmp 2792 ACD3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6835.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DEDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4579.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 68B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 177.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8D51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5428.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9369.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A728.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D20E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 88A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2436 1696 2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe 30 PID 1696 wrote to memory of 2436 1696 2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe 30 PID 1696 wrote to memory of 2436 1696 2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe 30 PID 1696 wrote to memory of 2436 1696 2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe 30 PID 2436 wrote to memory of 2096 2436 9869.tmp 31 PID 2436 wrote to memory of 2096 2436 9869.tmp 31 PID 2436 wrote to memory of 2096 2436 9869.tmp 31 PID 2436 wrote to memory of 2096 2436 9869.tmp 31 PID 2096 wrote to memory of 2348 2096 98B7.tmp 32 PID 2096 wrote to memory of 2348 2096 98B7.tmp 32 PID 2096 wrote to memory of 2348 2096 98B7.tmp 32 PID 2096 wrote to memory of 2348 2096 98B7.tmp 32 PID 2348 wrote to memory of 2744 2348 9943.tmp 33 PID 2348 wrote to memory of 2744 2348 9943.tmp 33 PID 2348 wrote to memory of 2744 2348 9943.tmp 33 PID 2348 wrote to memory of 2744 2348 9943.tmp 33 PID 2744 wrote to memory of 2892 2744 99C0.tmp 34 PID 2744 wrote to memory of 2892 2744 99C0.tmp 34 PID 2744 wrote to memory of 2892 2744 99C0.tmp 34 PID 2744 wrote to memory of 2892 2744 99C0.tmp 34 PID 2892 wrote to memory of 2624 2892 9A4C.tmp 35 PID 2892 wrote to memory of 2624 2892 9A4C.tmp 35 PID 2892 wrote to memory of 2624 2892 9A4C.tmp 35 PID 2892 wrote to memory of 2624 2892 9A4C.tmp 35 PID 2624 wrote to memory of 2908 2624 9AC9.tmp 36 PID 2624 wrote to memory of 2908 2624 9AC9.tmp 36 PID 2624 wrote to memory of 2908 2624 9AC9.tmp 36 PID 2624 wrote to memory of 2908 2624 9AC9.tmp 36 PID 2908 wrote to memory of 2640 2908 9B46.tmp 37 PID 2908 wrote to memory of 2640 2908 9B46.tmp 37 PID 2908 wrote to memory of 2640 2908 9B46.tmp 37 PID 2908 wrote to memory of 2640 2908 9B46.tmp 37 PID 2640 wrote to memory of 2672 2640 9BB3.tmp 38 PID 2640 wrote to memory of 2672 2640 9BB3.tmp 38 PID 2640 wrote to memory of 2672 2640 9BB3.tmp 38 PID 2640 wrote to memory of 2672 2640 9BB3.tmp 38 PID 2672 wrote to memory of 2632 2672 9C20.tmp 39 PID 2672 wrote to memory of 2632 2672 9C20.tmp 39 PID 2672 wrote to memory of 2632 2672 9C20.tmp 39 PID 2672 wrote to memory of 2632 2672 9C20.tmp 39 PID 2632 wrote to memory of 2784 2632 9C9D.tmp 40 PID 2632 wrote to memory of 2784 2632 9C9D.tmp 40 PID 2632 wrote to memory of 2784 2632 9C9D.tmp 40 PID 2632 wrote to memory of 2784 2632 9C9D.tmp 40 PID 2784 wrote to memory of 2252 2784 9D1A.tmp 41 PID 2784 wrote to memory of 2252 2784 9D1A.tmp 41 PID 2784 wrote to memory of 2252 2784 9D1A.tmp 41 PID 2784 wrote to memory of 2252 2784 9D1A.tmp 41 PID 2252 wrote to memory of 276 2252 9DA6.tmp 42 PID 2252 wrote to memory of 276 2252 9DA6.tmp 42 PID 2252 wrote to memory of 276 2252 9DA6.tmp 42 PID 2252 wrote to memory of 276 2252 9DA6.tmp 42 PID 276 wrote to memory of 1476 276 9E04.tmp 43 PID 276 wrote to memory of 1476 276 9E04.tmp 43 PID 276 wrote to memory of 1476 276 9E04.tmp 43 PID 276 wrote to memory of 1476 276 9E04.tmp 43 PID 1476 wrote to memory of 2716 1476 9E71.tmp 44 PID 1476 wrote to memory of 2716 1476 9E71.tmp 44 PID 1476 wrote to memory of 2716 1476 9E71.tmp 44 PID 1476 wrote to memory of 2716 1476 9E71.tmp 44 PID 2716 wrote to memory of 388 2716 9EEE.tmp 45 PID 2716 wrote to memory of 388 2716 9EEE.tmp 45 PID 2716 wrote to memory of 388 2716 9EEE.tmp 45 PID 2716 wrote to memory of 388 2716 9EEE.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_6cbfe490f328aeb2a45210c766385e77_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"C:\Users\Admin\AppData\Local\Temp\9D1A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"C:\Users\Admin\AppData\Local\Temp\9DA6.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9E04.tmp"C:\Users\Admin\AppData\Local\Temp\9E04.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Users\Admin\AppData\Local\Temp\9E71.tmp"C:\Users\Admin\AppData\Local\Temp\9E71.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:388 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\A16D.tmp"C:\Users\Admin\AppData\Local\Temp\A16D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:280 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"C:\Users\Admin\AppData\Local\Temp\A2F3.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"C:\Users\Admin\AppData\Local\Temp\A5F0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:664 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"C:\Users\Admin\AppData\Local\Temp\A9D6.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"C:\Users\Admin\AppData\Local\Temp\ABC9.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\AC08.tmp"C:\Users\Admin\AppData\Local\Temp\AC08.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AC46.tmp"C:\Users\Admin\AppData\Local\Temp\AC46.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"65⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"66⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"67⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"68⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"69⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"70⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"71⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"72⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"73⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"74⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"77⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"78⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"79⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"80⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"81⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"82⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"83⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"84⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"85⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"86⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"87⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"88⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"89⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"90⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"91⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"92⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\B403.tmp"C:\Users\Admin\AppData\Local\Temp\B403.tmp"93⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"94⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"95⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"96⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"97⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"98⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"99⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"C:\Users\Admin\AppData\Local\Temp\B5C8.tmp"100⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"101⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B645.tmp"C:\Users\Admin\AppData\Local\Temp\B645.tmp"102⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"103⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"C:\Users\Admin\AppData\Local\Temp\B6C1.tmp"104⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"105⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"106⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"107⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"108⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B809.tmp"C:\Users\Admin\AppData\Local\Temp\B809.tmp"109⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\B847.tmp"C:\Users\Admin\AppData\Local\Temp\B847.tmp"110⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B886.tmp"C:\Users\Admin\AppData\Local\Temp\B886.tmp"111⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"112⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\B903.tmp"C:\Users\Admin\AppData\Local\Temp\B903.tmp"113⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"114⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"115⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"116⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"117⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"118⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"119⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"120⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"121⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"122⤵PID:2884
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-