Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
18/08/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe
-
Size
488KB
-
MD5
9c9a460ef279653f34d3037cdd2c5129
-
SHA1
f3cf587e660ff6c1b365228bb2bf49995c9e438a
-
SHA256
9cc4928b465b26c5ad0ffe2da0895d3e9b58ccf444a93ad4af4bf3b7ad237898
-
SHA512
467d41ab8da1d0a676922f3bd7d164ef666ee5533048dae9f9b4e5942ee7096d54a611cf3a392b445830f19b4a156a24b73c70f285cf138ef12a27a3d8d650a1
-
SSDEEP
12288:/U5rCOTeiDXOKyrXKnXEvMhKbKnl9eTnaNZ:/UQOJDXhyrXK0JKnGaN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 496 C948.tmp 3016 C9A5.tmp 2336 CA32.tmp 2308 CA9F.tmp 2888 CAFD.tmp 2784 CB6A.tmp 2848 CBC7.tmp 2180 CC35.tmp 2808 CCA2.tmp 2936 CD0F.tmp 2672 CD7C.tmp 2780 CDE9.tmp 2172 CE66.tmp 1324 CEE3.tmp 2036 CF6F.tmp 2240 CFDD.tmp 2532 D059.tmp 2968 D0B7.tmp 1316 D124.tmp 2984 D1A1.tmp 1980 D20E.tmp 2168 D26C.tmp 3004 D2D9.tmp 316 D318.tmp 2008 D356.tmp 1356 D394.tmp 448 D3F2.tmp 2072 D45F.tmp 2500 D4AD.tmp 2476 D4EC.tmp 2256 D53A.tmp 1864 D588.tmp 2412 D5D6.tmp 900 D614.tmp 2636 D652.tmp 1524 D6A0.tmp 2112 D6DF.tmp 1880 D71D.tmp 2248 D76B.tmp 1528 D7B9.tmp 2344 D807.tmp 1388 D846.tmp 344 D894.tmp 1748 D8E2.tmp 596 D930.tmp 2016 D97E.tmp 852 D9CC.tmp 1496 DA1A.tmp 2388 DA68.tmp 1204 DAB6.tmp 2380 DAF4.tmp 2580 DB42.tmp 1632 DB90.tmp 1628 DBDE.tmp 3056 DC3C.tmp 1148 DC7A.tmp 1784 DCC8.tmp 2316 DD26.tmp 2664 DD74.tmp 2892 DDB2.tmp 2980 DE00.tmp 2876 DE3E.tmp 2804 DE7D.tmp 2320 DECB.tmp -
Loads dropped DLL 64 IoCs
pid Process 3056 2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe 496 C948.tmp 3016 C9A5.tmp 2336 CA32.tmp 2308 CA9F.tmp 2888 CAFD.tmp 2784 CB6A.tmp 2848 CBC7.tmp 2180 CC35.tmp 2808 CCA2.tmp 2936 CD0F.tmp 2672 CD7C.tmp 2780 CDE9.tmp 2172 CE66.tmp 1324 CEE3.tmp 2036 CF6F.tmp 2240 CFDD.tmp 2532 D059.tmp 2968 D0B7.tmp 1316 D124.tmp 2984 D1A1.tmp 1980 D20E.tmp 2168 D26C.tmp 3004 D2D9.tmp 316 D318.tmp 2008 D356.tmp 1356 D394.tmp 448 D3F2.tmp 2072 D45F.tmp 2500 D4AD.tmp 2476 D4EC.tmp 2256 D53A.tmp 1864 D588.tmp 2412 D5D6.tmp 900 D614.tmp 2636 D652.tmp 1524 D6A0.tmp 2112 D6DF.tmp 1880 D71D.tmp 2248 D76B.tmp 1528 D7B9.tmp 2344 D807.tmp 1388 D846.tmp 344 D894.tmp 1748 D8E2.tmp 596 D930.tmp 2016 D97E.tmp 852 D9CC.tmp 1496 DA1A.tmp 2388 DA68.tmp 1204 DAB6.tmp 2380 DAF4.tmp 2580 DB42.tmp 1632 DB90.tmp 1628 DBDE.tmp 3056 DC3C.tmp 1148 DC7A.tmp 1784 DCC8.tmp 2316 DD26.tmp 2664 DD74.tmp 2892 DDB2.tmp 2980 DE00.tmp 2876 DE3E.tmp 2804 DE7D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAAD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 341B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AA9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A2F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D0F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6883.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 41D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 586D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6123.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D02B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B377.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 187.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2175.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 496 3056 2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe 30 PID 3056 wrote to memory of 496 3056 2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe 30 PID 3056 wrote to memory of 496 3056 2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe 30 PID 3056 wrote to memory of 496 3056 2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe 30 PID 496 wrote to memory of 3016 496 C948.tmp 31 PID 496 wrote to memory of 3016 496 C948.tmp 31 PID 496 wrote to memory of 3016 496 C948.tmp 31 PID 496 wrote to memory of 3016 496 C948.tmp 31 PID 3016 wrote to memory of 2336 3016 C9A5.tmp 32 PID 3016 wrote to memory of 2336 3016 C9A5.tmp 32 PID 3016 wrote to memory of 2336 3016 C9A5.tmp 32 PID 3016 wrote to memory of 2336 3016 C9A5.tmp 32 PID 2336 wrote to memory of 2308 2336 CA32.tmp 33 PID 2336 wrote to memory of 2308 2336 CA32.tmp 33 PID 2336 wrote to memory of 2308 2336 CA32.tmp 33 PID 2336 wrote to memory of 2308 2336 CA32.tmp 33 PID 2308 wrote to memory of 2888 2308 CA9F.tmp 34 PID 2308 wrote to memory of 2888 2308 CA9F.tmp 34 PID 2308 wrote to memory of 2888 2308 CA9F.tmp 34 PID 2308 wrote to memory of 2888 2308 CA9F.tmp 34 PID 2888 wrote to memory of 2784 2888 CAFD.tmp 35 PID 2888 wrote to memory of 2784 2888 CAFD.tmp 35 PID 2888 wrote to memory of 2784 2888 CAFD.tmp 35 PID 2888 wrote to memory of 2784 2888 CAFD.tmp 35 PID 2784 wrote to memory of 2848 2784 CB6A.tmp 36 PID 2784 wrote to memory of 2848 2784 CB6A.tmp 36 PID 2784 wrote to memory of 2848 2784 CB6A.tmp 36 PID 2784 wrote to memory of 2848 2784 CB6A.tmp 36 PID 2848 wrote to memory of 2180 2848 CBC7.tmp 37 PID 2848 wrote to memory of 2180 2848 CBC7.tmp 37 PID 2848 wrote to memory of 2180 2848 CBC7.tmp 37 PID 2848 wrote to memory of 2180 2848 CBC7.tmp 37 PID 2180 wrote to memory of 2808 2180 CC35.tmp 38 PID 2180 wrote to memory of 2808 2180 CC35.tmp 38 PID 2180 wrote to memory of 2808 2180 CC35.tmp 38 PID 2180 wrote to memory of 2808 2180 CC35.tmp 38 PID 2808 wrote to memory of 2936 2808 CCA2.tmp 39 PID 2808 wrote to memory of 2936 2808 CCA2.tmp 39 PID 2808 wrote to memory of 2936 2808 CCA2.tmp 39 PID 2808 wrote to memory of 2936 2808 CCA2.tmp 39 PID 2936 wrote to memory of 2672 2936 CD0F.tmp 40 PID 2936 wrote to memory of 2672 2936 CD0F.tmp 40 PID 2936 wrote to memory of 2672 2936 CD0F.tmp 40 PID 2936 wrote to memory of 2672 2936 CD0F.tmp 40 PID 2672 wrote to memory of 2780 2672 CD7C.tmp 41 PID 2672 wrote to memory of 2780 2672 CD7C.tmp 41 PID 2672 wrote to memory of 2780 2672 CD7C.tmp 41 PID 2672 wrote to memory of 2780 2672 CD7C.tmp 41 PID 2780 wrote to memory of 2172 2780 CDE9.tmp 42 PID 2780 wrote to memory of 2172 2780 CDE9.tmp 42 PID 2780 wrote to memory of 2172 2780 CDE9.tmp 42 PID 2780 wrote to memory of 2172 2780 CDE9.tmp 42 PID 2172 wrote to memory of 1324 2172 CE66.tmp 43 PID 2172 wrote to memory of 1324 2172 CE66.tmp 43 PID 2172 wrote to memory of 1324 2172 CE66.tmp 43 PID 2172 wrote to memory of 1324 2172 CE66.tmp 43 PID 1324 wrote to memory of 2036 1324 CEE3.tmp 44 PID 1324 wrote to memory of 2036 1324 CEE3.tmp 44 PID 1324 wrote to memory of 2036 1324 CEE3.tmp 44 PID 1324 wrote to memory of 2036 1324 CEE3.tmp 44 PID 2036 wrote to memory of 2240 2036 CF6F.tmp 45 PID 2036 wrote to memory of 2240 2036 CF6F.tmp 45 PID 2036 wrote to memory of 2240 2036 CF6F.tmp 45 PID 2036 wrote to memory of 2240 2036 CF6F.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-18_9c9a460ef279653f34d3037cdd2c5129_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"C:\Users\Admin\AppData\Local\Temp\C9A5.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"C:\Users\Admin\AppData\Local\Temp\CFDD.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\D059.tmp"C:\Users\Admin\AppData\Local\Temp\D059.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"C:\Users\Admin\AppData\Local\Temp\D1A1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\D20E.tmp"C:\Users\Admin\AppData\Local\Temp\D20E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"C:\Users\Admin\AppData\Local\Temp\D2D9.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\D318.tmp"C:\Users\Admin\AppData\Local\Temp\D318.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\D356.tmp"C:\Users\Admin\AppData\Local\Temp\D356.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D394.tmp"C:\Users\Admin\AppData\Local\Temp\D394.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\D45F.tmp"C:\Users\Admin\AppData\Local\Temp\D45F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\D4EC.tmp"C:\Users\Admin\AppData\Local\Temp\D4EC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\D53A.tmp"C:\Users\Admin\AppData\Local\Temp\D53A.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\D588.tmp"C:\Users\Admin\AppData\Local\Temp\D588.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"C:\Users\Admin\AppData\Local\Temp\D5D6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\D614.tmp"C:\Users\Admin\AppData\Local\Temp\D614.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\D652.tmp"C:\Users\Admin\AppData\Local\Temp\D652.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"C:\Users\Admin\AppData\Local\Temp\D7B9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\D846.tmp"C:\Users\Admin\AppData\Local\Temp\D846.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\D894.tmp"C:\Users\Admin\AppData\Local\Temp\D894.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\D930.tmp"C:\Users\Admin\AppData\Local\Temp\D930.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:596 -
C:\Users\Admin\AppData\Local\Temp\D97E.tmp"C:\Users\Admin\AppData\Local\Temp\D97E.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"C:\Users\Admin\AppData\Local\Temp\D9CC.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"C:\Users\Admin\AppData\Local\Temp\DA1A.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"C:\Users\Admin\AppData\Local\Temp\DAB6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"C:\Users\Admin\AppData\Local\Temp\DAF4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\DB90.tmp"C:\Users\Admin\AppData\Local\Temp\DB90.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\DC3C.tmp"C:\Users\Admin\AppData\Local\Temp\DC3C.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"C:\Users\Admin\AppData\Local\Temp\DCC8.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\DD26.tmp"C:\Users\Admin\AppData\Local\Temp\DD26.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\DD74.tmp"C:\Users\Admin\AppData\Local\Temp\DD74.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\DE00.tmp"C:\Users\Admin\AppData\Local\Temp\DE00.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"C:\Users\Admin\AppData\Local\Temp\DE3E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"C:\Users\Admin\AppData\Local\Temp\DE7D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"65⤵
- Executes dropped EXE
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"66⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\DF57.tmp"C:\Users\Admin\AppData\Local\Temp\DF57.tmp"67⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"68⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"69⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\E032.tmp"C:\Users\Admin\AppData\Local\Temp\E032.tmp"70⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\E080.tmp"C:\Users\Admin\AppData\Local\Temp\E080.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"C:\Users\Admin\AppData\Local\Temp\E0BE.tmp"72⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"73⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"74⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"75⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"76⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"77⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\E263.tmp"C:\Users\Admin\AppData\Local\Temp\E263.tmp"78⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"C:\Users\Admin\AppData\Local\Temp\E2B1.tmp"79⤵
- System Location Discovery: System Language Discovery
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"C:\Users\Admin\AppData\Local\Temp\E2FF.tmp"80⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"81⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"82⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"83⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\E418.tmp"C:\Users\Admin\AppData\Local\Temp\E418.tmp"84⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\E466.tmp"C:\Users\Admin\AppData\Local\Temp\E466.tmp"85⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"86⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"87⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\E550.tmp"C:\Users\Admin\AppData\Local\Temp\E550.tmp"88⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\E58E.tmp"C:\Users\Admin\AppData\Local\Temp\E58E.tmp"89⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"90⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\E61B.tmp"C:\Users\Admin\AppData\Local\Temp\E61B.tmp"91⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"92⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"93⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"94⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"95⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"96⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"97⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"C:\Users\Admin\AppData\Local\Temp\E7FE.tmp"98⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\E84C.tmp"C:\Users\Admin\AppData\Local\Temp\E84C.tmp"99⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"100⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"C:\Users\Admin\AppData\Local\Temp\E8C9.tmp"101⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\E917.tmp"C:\Users\Admin\AppData\Local\Temp\E917.tmp"102⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"103⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\E994.tmp"C:\Users\Admin\AppData\Local\Temp\E994.tmp"104⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"C:\Users\Admin\AppData\Local\Temp\E9E2.tmp"105⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\EA20.tmp"C:\Users\Admin\AppData\Local\Temp\EA20.tmp"106⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"107⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"C:\Users\Admin\AppData\Local\Temp\EAAD.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"C:\Users\Admin\AppData\Local\Temp\EAEB.tmp"109⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"110⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"111⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"C:\Users\Admin\AppData\Local\Temp\EBC6.tmp"112⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\EC04.tmp"C:\Users\Admin\AppData\Local\Temp\EC04.tmp"113⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"114⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\EC90.tmp"C:\Users\Admin\AppData\Local\Temp\EC90.tmp"115⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"C:\Users\Admin\AppData\Local\Temp\ECDE.tmp"116⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"C:\Users\Admin\AppData\Local\Temp\ED1D.tmp"117⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"C:\Users\Admin\AppData\Local\Temp\ED5B.tmp"118⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"C:\Users\Admin\AppData\Local\Temp\EDA9.tmp"119⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"C:\Users\Admin\AppData\Local\Temp\EDF7.tmp"120⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\EE45.tmp"C:\Users\Admin\AppData\Local\Temp\EE45.tmp"121⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\EE84.tmp"C:\Users\Admin\AppData\Local\Temp\EE84.tmp"122⤵PID:3016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-