Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/08/2024, 00:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe
-
Size
536KB
-
MD5
10c8bb5df011ebcdd1fabf48a7882e96
-
SHA1
6ffd666f3e19afa0dfd0b33bbd9f6539c19189e1
-
SHA256
7fc95d4bacd8c1a37cc7d825affad194b1e11d730cfd1927394761a6e956ba37
-
SHA512
e44f7482928630e677ccbe5bbd1fa6eff5b60580caa68bbe26ab3e151547f9ae453abed791d5dccd4cc9575af78fe6684338e5b410127d2c3720b78647f636eb
-
SSDEEP
12288:wU5rCOTeiUoBVWNcGFXv+cVutnGCYpRuIZxVJ0ZT9:wUQOJUoBwNcGF/+AWs6IRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2176 7E73.tmp 1980 7FAB.tmp 2760 80E3.tmp 2692 816F.tmp 1800 81FC.tmp 2752 8279.tmp 2704 82F5.tmp 2552 8382.tmp 3004 840E.tmp 2520 849B.tmp 2040 8527.tmp 2412 85C3.tmp 2736 865F.tmp 2884 86FB.tmp 3028 87A7.tmp 472 8862.tmp 2056 88BF.tmp 2844 895B.tmp 1492 89F7.tmp 2716 8A84.tmp 2172 8B20.tmp 2196 8B9D.tmp 1648 8C0A.tmp 1392 8C96.tmp 1268 8D23.tmp 2388 8DBF.tmp 2460 8E4B.tmp 1004 8ED7.tmp 828 8F73.tmp 1540 900F.tmp 1636 92ED.tmp 1860 93B7.tmp 2624 9463.tmp 276 94FF.tmp 1840 95AB.tmp 2336 9647.tmp 556 96F2.tmp 888 978E.tmp 2384 981B.tmp 1600 98B7.tmp 2156 9962.tmp 2148 99FE.tmp 2780 9A9A.tmp 2936 9B27.tmp 2904 9BC3.tmp 2812 9C5F.tmp 2588 9CFB.tmp 2656 9D97.tmp 2244 9E33.tmp 2132 9F5B.tmp 2532 9FE7.tmp 2796 A055.tmp 3040 A0C2.tmp 1976 A14E.tmp 2960 A1CB.tmp 1792 A238.tmp 1036 A296.tmp 1096 A341.tmp 2804 A39F.tmp 2288 A41C.tmp 1804 A489.tmp 2044 A515.tmp 1676 A592.tmp 588 A62E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2084 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 2176 7E73.tmp 1980 7FAB.tmp 2760 80E3.tmp 2692 816F.tmp 1800 81FC.tmp 2752 8279.tmp 2704 82F5.tmp 2552 8382.tmp 3004 840E.tmp 2520 849B.tmp 2040 8527.tmp 2412 85C3.tmp 2736 865F.tmp 2884 86FB.tmp 3028 87A7.tmp 472 8862.tmp 2056 88BF.tmp 2844 895B.tmp 1492 89F7.tmp 2716 8A84.tmp 2172 8B20.tmp 2196 8B9D.tmp 1648 8C0A.tmp 1392 8C96.tmp 1268 8D23.tmp 2388 8DBF.tmp 2460 8E4B.tmp 1004 8ED7.tmp 828 8F73.tmp 1540 900F.tmp 1636 92ED.tmp 1860 93B7.tmp 2624 9463.tmp 276 94FF.tmp 1840 95AB.tmp 2336 9647.tmp 556 96F2.tmp 888 978E.tmp 2384 981B.tmp 1600 98B7.tmp 2156 9962.tmp 2148 99FE.tmp 2780 9A9A.tmp 2936 9B27.tmp 2904 9BC3.tmp 2812 9C5F.tmp 2588 9CFB.tmp 2656 9D97.tmp 2244 9E33.tmp 2132 9F5B.tmp 2532 9FE7.tmp 2796 A055.tmp 3040 A0C2.tmp 1976 A14E.tmp 2960 A1CB.tmp 1792 A238.tmp 1036 A296.tmp 1096 A341.tmp 2804 A39F.tmp 2288 A41C.tmp 1804 A489.tmp 2044 A515.tmp 1676 A592.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE76.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E56F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B55B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 475D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E13B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3DA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 27CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FCA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9E34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A45A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ADD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7484.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2904.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15E1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 670D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 147B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D8E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A14E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F180.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3958.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C562.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2176 2084 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 30 PID 2084 wrote to memory of 2176 2084 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 30 PID 2084 wrote to memory of 2176 2084 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 30 PID 2084 wrote to memory of 2176 2084 2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe 30 PID 2176 wrote to memory of 1980 2176 7E73.tmp 31 PID 2176 wrote to memory of 1980 2176 7E73.tmp 31 PID 2176 wrote to memory of 1980 2176 7E73.tmp 31 PID 2176 wrote to memory of 1980 2176 7E73.tmp 31 PID 1980 wrote to memory of 2760 1980 7FAB.tmp 32 PID 1980 wrote to memory of 2760 1980 7FAB.tmp 32 PID 1980 wrote to memory of 2760 1980 7FAB.tmp 32 PID 1980 wrote to memory of 2760 1980 7FAB.tmp 32 PID 2760 wrote to memory of 2692 2760 80E3.tmp 33 PID 2760 wrote to memory of 2692 2760 80E3.tmp 33 PID 2760 wrote to memory of 2692 2760 80E3.tmp 33 PID 2760 wrote to memory of 2692 2760 80E3.tmp 33 PID 2692 wrote to memory of 1800 2692 816F.tmp 34 PID 2692 wrote to memory of 1800 2692 816F.tmp 34 PID 2692 wrote to memory of 1800 2692 816F.tmp 34 PID 2692 wrote to memory of 1800 2692 816F.tmp 34 PID 1800 wrote to memory of 2752 1800 81FC.tmp 35 PID 1800 wrote to memory of 2752 1800 81FC.tmp 35 PID 1800 wrote to memory of 2752 1800 81FC.tmp 35 PID 1800 wrote to memory of 2752 1800 81FC.tmp 35 PID 2752 wrote to memory of 2704 2752 8279.tmp 36 PID 2752 wrote to memory of 2704 2752 8279.tmp 36 PID 2752 wrote to memory of 2704 2752 8279.tmp 36 PID 2752 wrote to memory of 2704 2752 8279.tmp 36 PID 2704 wrote to memory of 2552 2704 82F5.tmp 37 PID 2704 wrote to memory of 2552 2704 82F5.tmp 37 PID 2704 wrote to memory of 2552 2704 82F5.tmp 37 PID 2704 wrote to memory of 2552 2704 82F5.tmp 37 PID 2552 wrote to memory of 3004 2552 8382.tmp 38 PID 2552 wrote to memory of 3004 2552 8382.tmp 38 PID 2552 wrote to memory of 3004 2552 8382.tmp 38 PID 2552 wrote to memory of 3004 2552 8382.tmp 38 PID 3004 wrote to memory of 2520 3004 840E.tmp 39 PID 3004 wrote to memory of 2520 3004 840E.tmp 39 PID 3004 wrote to memory of 2520 3004 840E.tmp 39 PID 3004 wrote to memory of 2520 3004 840E.tmp 39 PID 2520 wrote to memory of 2040 2520 849B.tmp 40 PID 2520 wrote to memory of 2040 2520 849B.tmp 40 PID 2520 wrote to memory of 2040 2520 849B.tmp 40 PID 2520 wrote to memory of 2040 2520 849B.tmp 40 PID 2040 wrote to memory of 2412 2040 8527.tmp 41 PID 2040 wrote to memory of 2412 2040 8527.tmp 41 PID 2040 wrote to memory of 2412 2040 8527.tmp 41 PID 2040 wrote to memory of 2412 2040 8527.tmp 41 PID 2412 wrote to memory of 2736 2412 85C3.tmp 42 PID 2412 wrote to memory of 2736 2412 85C3.tmp 42 PID 2412 wrote to memory of 2736 2412 85C3.tmp 42 PID 2412 wrote to memory of 2736 2412 85C3.tmp 42 PID 2736 wrote to memory of 2884 2736 865F.tmp 43 PID 2736 wrote to memory of 2884 2736 865F.tmp 43 PID 2736 wrote to memory of 2884 2736 865F.tmp 43 PID 2736 wrote to memory of 2884 2736 865F.tmp 43 PID 2884 wrote to memory of 3028 2884 86FB.tmp 44 PID 2884 wrote to memory of 3028 2884 86FB.tmp 44 PID 2884 wrote to memory of 3028 2884 86FB.tmp 44 PID 2884 wrote to memory of 3028 2884 86FB.tmp 44 PID 3028 wrote to memory of 472 3028 87A7.tmp 45 PID 3028 wrote to memory of 472 3028 87A7.tmp 45 PID 3028 wrote to memory of 472 3028 87A7.tmp 45 PID 3028 wrote to memory of 472 3028 87A7.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-12_10c8bb5df011ebcdd1fabf48a7882e96_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7E73.tmp"C:\Users\Admin\AppData\Local\Temp\7E73.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\80E3.tmp"C:\Users\Admin\AppData\Local\Temp\80E3.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\81FC.tmp"C:\Users\Admin\AppData\Local\Temp\81FC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\8527.tmp"C:\Users\Admin\AppData\Local\Temp\8527.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\85C3.tmp"C:\Users\Admin\AppData\Local\Temp\85C3.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:472 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\895B.tmp"C:\Users\Admin\AppData\Local\Temp\895B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\8B20.tmp"C:\Users\Admin\AppData\Local\Temp\8B20.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"C:\Users\Admin\AppData\Local\Temp\8C0A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"C:\Users\Admin\AppData\Local\Temp\8ED7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\92ED.tmp"C:\Users\Admin\AppData\Local\Temp\92ED.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\96F2.tmp"C:\Users\Admin\AppData\Local\Temp\96F2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:556 -
C:\Users\Admin\AppData\Local\Temp\978E.tmp"C:\Users\Admin\AppData\Local\Temp\978E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\9E33.tmp"C:\Users\Admin\AppData\Local\Temp\9E33.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"C:\Users\Admin\AppData\Local\Temp\9FE7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"C:\Users\Admin\AppData\Local\Temp\A0C2.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A14E.tmp"C:\Users\Admin\AppData\Local\Temp\A14E.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\A238.tmp"C:\Users\Admin\AppData\Local\Temp\A238.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\A296.tmp"C:\Users\Admin\AppData\Local\Temp\A296.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\A489.tmp"C:\Users\Admin\AppData\Local\Temp\A489.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"65⤵
- Executes dropped EXE
PID:588 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"66⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"67⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"68⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"69⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"70⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"C:\Users\Admin\AppData\Local\Temp\AAFF.tmp"71⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"72⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"73⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"74⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"75⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"76⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"77⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"78⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"79⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"80⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"81⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"82⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"83⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"84⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"85⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"86⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"87⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"88⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"89⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"90⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"92⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"93⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"94⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\B683.tmp"C:\Users\Admin\AppData\Local\Temp\B683.tmp"95⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"96⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"97⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"98⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"99⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"100⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"101⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"102⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"103⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"104⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"105⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"106⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"C:\Users\Admin\AppData\Local\Temp\BBFF.tmp"107⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"108⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"109⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"110⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"111⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"112⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"113⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"114⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"115⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"116⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"117⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"118⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"119⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"120⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"121⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"122⤵PID:2208
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-