Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/08/2024, 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe
-
Size
488KB
-
MD5
5ef11cfa0f727b98714bc139a8eed44d
-
SHA1
dc323dcd9225998c724acb7f6b3a9adc15c79af7
-
SHA256
9182ead5c5ba40aa4f8b44ada23e8cc108e690bfad75a73ad02fd97cbb58df7d
-
SHA512
33ed8c8721f53e31580d8f90b50516bc812f1ed62c015ab3b98371d5b1d01357ffc5337fd53c898f9b1a173b3f23fa11d0c6e170ab337ce88cc88ba8994cf2ff
-
SSDEEP
12288:/U5rCOTeiD2GX8f+Vh1JRC/wKwtGWH/ENZ:/UQOJDu+Vhr8/wlGs/EN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2460 6B5.tmp 2408 703.tmp 2664 780.tmp 2748 7DD.tmp 2644 84A.tmp 2820 8B8.tmp 2844 925.tmp 2752 992.tmp 2520 9FF.tmp 2592 A7C.tmp 2348 ADA.tmp 2768 B47.tmp 2060 BA4.tmp 2868 C12.tmp 2764 C60.tmp 2872 CDC.tmp 1192 D4A.tmp 324 DA7.tmp 3036 E05.tmp 1724 E62.tmp 2500 ED0.tmp 1744 F3D.tmp 2384 F8B.tmp 1652 FC9.tmp 2156 1017.tmp 2288 1056.tmp 1732 10A4.tmp 2148 10F2.tmp 2896 1130.tmp 1128 117E.tmp 1900 11CC.tmp 816 120A.tmp 2488 1258.tmp 884 12A6.tmp 936 12E5.tmp 1284 1323.tmp 1772 1362.tmp 1832 13B0.tmp 1548 13FE.tmp 2468 143C.tmp 1088 148A.tmp 1764 14C8.tmp 3020 1507.tmp 1584 1545.tmp 1000 1584.tmp 1932 15C2.tmp 2328 1610.tmp 980 164E.tmp 988 168D.tmp 748 16CB.tmp 2440 1719.tmp 392 1758.tmp 1476 17E4.tmp 2364 1832.tmp 2260 1870.tmp 1640 18AF.tmp 2744 18FD.tmp 2676 193B.tmp 2980 1989.tmp 2252 19C8.tmp 2636 1A16.tmp 2552 1A54.tmp 2684 1AA2.tmp 2688 1AE0.tmp -
Loads dropped DLL 64 IoCs
pid Process 1476 2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe 2460 6B5.tmp 2408 703.tmp 2664 780.tmp 2748 7DD.tmp 2644 84A.tmp 2820 8B8.tmp 2844 925.tmp 2752 992.tmp 2520 9FF.tmp 2592 A7C.tmp 2348 ADA.tmp 2768 B47.tmp 2060 BA4.tmp 2868 C12.tmp 2764 C60.tmp 2872 CDC.tmp 1192 D4A.tmp 324 DA7.tmp 3036 E05.tmp 1724 E62.tmp 2500 ED0.tmp 1744 F3D.tmp 2384 F8B.tmp 1652 FC9.tmp 2156 1017.tmp 2288 1056.tmp 1732 10A4.tmp 2148 10F2.tmp 2896 1130.tmp 1128 117E.tmp 1900 11CC.tmp 816 120A.tmp 2488 1258.tmp 884 12A6.tmp 936 12E5.tmp 1284 1323.tmp 1772 1362.tmp 1832 13B0.tmp 1548 13FE.tmp 2468 143C.tmp 1088 148A.tmp 1764 14C8.tmp 3020 1507.tmp 1584 1545.tmp 1000 1584.tmp 1932 15C2.tmp 2328 1610.tmp 980 164E.tmp 988 168D.tmp 748 16CB.tmp 2440 1719.tmp 2432 1796.tmp 1476 17E4.tmp 2364 1832.tmp 2260 1870.tmp 1640 18AF.tmp 2744 18FD.tmp 2676 193B.tmp 2980 1989.tmp 2252 19C8.tmp 2636 1A16.tmp 2552 1A54.tmp 2684 1AA2.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7436.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 896B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B8A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F22C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 201E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9972.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4894.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7475.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C8EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C17B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7530.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78F7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A515.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B931.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EDA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6596.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAF2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1476 wrote to memory of 2460 1476 2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe 30 PID 1476 wrote to memory of 2460 1476 2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe 30 PID 1476 wrote to memory of 2460 1476 2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe 30 PID 1476 wrote to memory of 2460 1476 2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe 30 PID 2460 wrote to memory of 2408 2460 6B5.tmp 31 PID 2460 wrote to memory of 2408 2460 6B5.tmp 31 PID 2460 wrote to memory of 2408 2460 6B5.tmp 31 PID 2460 wrote to memory of 2408 2460 6B5.tmp 31 PID 2408 wrote to memory of 2664 2408 703.tmp 32 PID 2408 wrote to memory of 2664 2408 703.tmp 32 PID 2408 wrote to memory of 2664 2408 703.tmp 32 PID 2408 wrote to memory of 2664 2408 703.tmp 32 PID 2664 wrote to memory of 2748 2664 780.tmp 33 PID 2664 wrote to memory of 2748 2664 780.tmp 33 PID 2664 wrote to memory of 2748 2664 780.tmp 33 PID 2664 wrote to memory of 2748 2664 780.tmp 33 PID 2748 wrote to memory of 2644 2748 7DD.tmp 34 PID 2748 wrote to memory of 2644 2748 7DD.tmp 34 PID 2748 wrote to memory of 2644 2748 7DD.tmp 34 PID 2748 wrote to memory of 2644 2748 7DD.tmp 34 PID 2644 wrote to memory of 2820 2644 84A.tmp 35 PID 2644 wrote to memory of 2820 2644 84A.tmp 35 PID 2644 wrote to memory of 2820 2644 84A.tmp 35 PID 2644 wrote to memory of 2820 2644 84A.tmp 35 PID 2820 wrote to memory of 2844 2820 8B8.tmp 36 PID 2820 wrote to memory of 2844 2820 8B8.tmp 36 PID 2820 wrote to memory of 2844 2820 8B8.tmp 36 PID 2820 wrote to memory of 2844 2820 8B8.tmp 36 PID 2844 wrote to memory of 2752 2844 925.tmp 37 PID 2844 wrote to memory of 2752 2844 925.tmp 37 PID 2844 wrote to memory of 2752 2844 925.tmp 37 PID 2844 wrote to memory of 2752 2844 925.tmp 37 PID 2752 wrote to memory of 2520 2752 992.tmp 38 PID 2752 wrote to memory of 2520 2752 992.tmp 38 PID 2752 wrote to memory of 2520 2752 992.tmp 38 PID 2752 wrote to memory of 2520 2752 992.tmp 38 PID 2520 wrote to memory of 2592 2520 9FF.tmp 39 PID 2520 wrote to memory of 2592 2520 9FF.tmp 39 PID 2520 wrote to memory of 2592 2520 9FF.tmp 39 PID 2520 wrote to memory of 2592 2520 9FF.tmp 39 PID 2592 wrote to memory of 2348 2592 A7C.tmp 40 PID 2592 wrote to memory of 2348 2592 A7C.tmp 40 PID 2592 wrote to memory of 2348 2592 A7C.tmp 40 PID 2592 wrote to memory of 2348 2592 A7C.tmp 40 PID 2348 wrote to memory of 2768 2348 ADA.tmp 41 PID 2348 wrote to memory of 2768 2348 ADA.tmp 41 PID 2348 wrote to memory of 2768 2348 ADA.tmp 41 PID 2348 wrote to memory of 2768 2348 ADA.tmp 41 PID 2768 wrote to memory of 2060 2768 B47.tmp 42 PID 2768 wrote to memory of 2060 2768 B47.tmp 42 PID 2768 wrote to memory of 2060 2768 B47.tmp 42 PID 2768 wrote to memory of 2060 2768 B47.tmp 42 PID 2060 wrote to memory of 2868 2060 BA4.tmp 43 PID 2060 wrote to memory of 2868 2060 BA4.tmp 43 PID 2060 wrote to memory of 2868 2060 BA4.tmp 43 PID 2060 wrote to memory of 2868 2060 BA4.tmp 43 PID 2868 wrote to memory of 2764 2868 C12.tmp 44 PID 2868 wrote to memory of 2764 2868 C12.tmp 44 PID 2868 wrote to memory of 2764 2868 C12.tmp 44 PID 2868 wrote to memory of 2764 2868 C12.tmp 44 PID 2764 wrote to memory of 2872 2764 C60.tmp 45 PID 2764 wrote to memory of 2872 2764 C60.tmp 45 PID 2764 wrote to memory of 2872 2764 C60.tmp 45 PID 2764 wrote to memory of 2872 2764 C60.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-10_5ef11cfa0f727b98714bc139a8eed44d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\6B5.tmp"C:\Users\Admin\AppData\Local\Temp\6B5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\703.tmp"C:\Users\Admin\AppData\Local\Temp\703.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\780.tmp"C:\Users\Admin\AppData\Local\Temp\780.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8B8.tmp"C:\Users\Admin\AppData\Local\Temp\8B8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\FC9.tmp"C:\Users\Admin\AppData\Local\Temp\FC9.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\120A.tmp"C:\Users\Admin\AppData\Local\Temp\120A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:936 -
C:\Users\Admin\AppData\Local\Temp\1323.tmp"C:\Users\Admin\AppData\Local\Temp\1323.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\13B0.tmp"C:\Users\Admin\AppData\Local\Temp\13B0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\1507.tmp"C:\Users\Admin\AppData\Local\Temp\1507.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\1545.tmp"C:\Users\Admin\AppData\Local\Temp\1545.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\15C2.tmp"C:\Users\Admin\AppData\Local\Temp\15C2.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\1610.tmp"C:\Users\Admin\AppData\Local\Temp\1610.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\164E.tmp"C:\Users\Admin\AppData\Local\Temp\164E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\168D.tmp"C:\Users\Admin\AppData\Local\Temp\168D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:988 -
C:\Users\Admin\AppData\Local\Temp\16CB.tmp"C:\Users\Admin\AppData\Local\Temp\16CB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:748 -
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"53⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"54⤵
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\18FD.tmp"C:\Users\Admin\AppData\Local\Temp\18FD.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\193B.tmp"C:\Users\Admin\AppData\Local\Temp\193B.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\1989.tmp"C:\Users\Admin\AppData\Local\Temp\1989.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\19C8.tmp"C:\Users\Admin\AppData\Local\Temp\19C8.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\1A16.tmp"C:\Users\Admin\AppData\Local\Temp\1A16.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1A54.tmp"C:\Users\Admin\AppData\Local\Temp\1A54.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"66⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"68⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"69⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"70⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"71⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"72⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"73⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"74⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"75⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"76⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"77⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"78⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"C:\Users\Admin\AppData\Local\Temp\1E1B.tmp"79⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"C:\Users\Admin\AppData\Local\Temp\1E5A.tmp"80⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1E98.tmp"C:\Users\Admin\AppData\Local\Temp\1E98.tmp"81⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"C:\Users\Admin\AppData\Local\Temp\1ED6.tmp"82⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\1F24.tmp"C:\Users\Admin\AppData\Local\Temp\1F24.tmp"83⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"84⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"C:\Users\Admin\AppData\Local\Temp\1FA1.tmp"85⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"86⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\201E.tmp"C:\Users\Admin\AppData\Local\Temp\201E.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"88⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\20AA.tmp"C:\Users\Admin\AppData\Local\Temp\20AA.tmp"89⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"90⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\2127.tmp"C:\Users\Admin\AppData\Local\Temp\2127.tmp"91⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"92⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"93⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"94⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"95⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"96⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"97⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"98⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"99⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"100⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"101⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"102⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"103⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"104⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"105⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"106⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"107⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"108⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"109⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"110⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"111⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"112⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"113⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\2710.tmp"C:\Users\Admin\AppData\Local\Temp\2710.tmp"114⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"115⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"116⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"117⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"118⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"119⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"120⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"121⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"122⤵PID:2728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-