Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
20/08/2024, 08:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe
-
Size
520KB
-
MD5
4a77b35843a87552704bec58aaedb91f
-
SHA1
19cf3c0a57388f267fca4aec4c6337310512e973
-
SHA256
eee4b14100ee10fd94f964af9a192308c794eaa6d70cf36a3c601ec89220a9a5
-
SHA512
49302e5025b5195640c077fe9947f0da81ec91aa2c3f95542fa811a810c81364698c57d6e616bf25392021fd140c72b7df0596060d3727e60cb7fce67d9980c5
-
SSDEEP
12288:roRXOQjmOy6FCYhZYd9ERG25zadgINd4vNZ:rogQ9y6Addb+zad54vN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2280 B98F.tmp 2324 B9ED.tmp 2328 BA5A.tmp 2556 BAB7.tmp 2704 BB25.tmp 2752 BB82.tmp 2832 BBEF.tmp 2716 BC5D.tmp 2984 BC9B.tmp 2940 BCE9.tmp 2800 BD47.tmp 2612 BDB4.tmp 2684 BE21.tmp 2664 BE8E.tmp 680 BEFB.tmp 844 BF59.tmp 1368 BFC6.tmp 2028 C033.tmp 1188 C091.tmp 1348 C0EF.tmp 2036 C14C.tmp 1908 C1B9.tmp 1912 C207.tmp 324 C246.tmp 2172 C284.tmp 2712 C2C3.tmp 2472 C301.tmp 2444 C33F.tmp 2476 C37E.tmp 2468 C3BC.tmp 1400 C3FB.tmp 2004 C439.tmp 1100 C487.tmp 3008 C4C5.tmp 848 C504.tmp 1288 C542.tmp 952 C581.tmp 840 C5BF.tmp 1964 C5FD.tmp 2248 C63C.tmp 852 C68A.tmp 1488 C6D8.tmp 2384 C716.tmp 3000 C755.tmp 2336 C793.tmp 2532 C7D1.tmp 2216 C810.tmp 484 C85E.tmp 1752 C89C.tmp 1244 C8DB.tmp 1432 C919.tmp 1740 C957.tmp 1532 C996.tmp 1528 C9D4.tmp 2296 CA13.tmp 2280 CA51.tmp 2144 CA8F.tmp 2252 CACE.tmp 2328 CB0C.tmp 2188 CB4B.tmp 1456 CB89.tmp 2576 CBC7.tmp 2828 CC06.tmp 2808 CC54.tmp -
Loads dropped DLL 64 IoCs
pid Process 2296 2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe 2280 B98F.tmp 2324 B9ED.tmp 2328 BA5A.tmp 2556 BAB7.tmp 2704 BB25.tmp 2752 BB82.tmp 2832 BBEF.tmp 2716 BC5D.tmp 2984 BC9B.tmp 2940 BCE9.tmp 2800 BD47.tmp 2612 BDB4.tmp 2684 BE21.tmp 2664 BE8E.tmp 680 BEFB.tmp 844 BF59.tmp 1368 BFC6.tmp 2028 C033.tmp 1188 C091.tmp 1348 C0EF.tmp 2036 C14C.tmp 1908 C1B9.tmp 1912 C207.tmp 324 C246.tmp 2172 C284.tmp 2712 C2C3.tmp 2472 C301.tmp 2444 C33F.tmp 2476 C37E.tmp 2468 C3BC.tmp 1400 C3FB.tmp 2004 C439.tmp 1100 C487.tmp 3008 C4C5.tmp 848 C504.tmp 1288 C542.tmp 952 C581.tmp 840 C5BF.tmp 1964 C5FD.tmp 2248 C63C.tmp 852 C68A.tmp 1488 C6D8.tmp 2384 C716.tmp 3000 C755.tmp 2336 C793.tmp 2532 C7D1.tmp 2216 C810.tmp 484 C85E.tmp 1752 C89C.tmp 1244 C8DB.tmp 1432 C919.tmp 1740 C957.tmp 1532 C996.tmp 1528 C9D4.tmp 2296 CA13.tmp 2280 CA51.tmp 2144 CA8F.tmp 2252 CACE.tmp 2328 CB0C.tmp 2188 CB4B.tmp 1456 CB89.tmp 2576 CBC7.tmp 2828 CC06.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E34D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F190.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 565A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 692F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9FF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8150.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E77.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B155.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 869D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 428C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 848B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3FD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3949.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2280 2296 2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe 30 PID 2296 wrote to memory of 2280 2296 2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe 30 PID 2296 wrote to memory of 2280 2296 2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe 30 PID 2296 wrote to memory of 2280 2296 2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe 30 PID 2280 wrote to memory of 2324 2280 B98F.tmp 31 PID 2280 wrote to memory of 2324 2280 B98F.tmp 31 PID 2280 wrote to memory of 2324 2280 B98F.tmp 31 PID 2280 wrote to memory of 2324 2280 B98F.tmp 31 PID 2324 wrote to memory of 2328 2324 B9ED.tmp 32 PID 2324 wrote to memory of 2328 2324 B9ED.tmp 32 PID 2324 wrote to memory of 2328 2324 B9ED.tmp 32 PID 2324 wrote to memory of 2328 2324 B9ED.tmp 32 PID 2328 wrote to memory of 2556 2328 BA5A.tmp 33 PID 2328 wrote to memory of 2556 2328 BA5A.tmp 33 PID 2328 wrote to memory of 2556 2328 BA5A.tmp 33 PID 2328 wrote to memory of 2556 2328 BA5A.tmp 33 PID 2556 wrote to memory of 2704 2556 BAB7.tmp 34 PID 2556 wrote to memory of 2704 2556 BAB7.tmp 34 PID 2556 wrote to memory of 2704 2556 BAB7.tmp 34 PID 2556 wrote to memory of 2704 2556 BAB7.tmp 34 PID 2704 wrote to memory of 2752 2704 BB25.tmp 35 PID 2704 wrote to memory of 2752 2704 BB25.tmp 35 PID 2704 wrote to memory of 2752 2704 BB25.tmp 35 PID 2704 wrote to memory of 2752 2704 BB25.tmp 35 PID 2752 wrote to memory of 2832 2752 BB82.tmp 36 PID 2752 wrote to memory of 2832 2752 BB82.tmp 36 PID 2752 wrote to memory of 2832 2752 BB82.tmp 36 PID 2752 wrote to memory of 2832 2752 BB82.tmp 36 PID 2832 wrote to memory of 2716 2832 BBEF.tmp 37 PID 2832 wrote to memory of 2716 2832 BBEF.tmp 37 PID 2832 wrote to memory of 2716 2832 BBEF.tmp 37 PID 2832 wrote to memory of 2716 2832 BBEF.tmp 37 PID 2716 wrote to memory of 2984 2716 BC5D.tmp 38 PID 2716 wrote to memory of 2984 2716 BC5D.tmp 38 PID 2716 wrote to memory of 2984 2716 BC5D.tmp 38 PID 2716 wrote to memory of 2984 2716 BC5D.tmp 38 PID 2984 wrote to memory of 2940 2984 BC9B.tmp 39 PID 2984 wrote to memory of 2940 2984 BC9B.tmp 39 PID 2984 wrote to memory of 2940 2984 BC9B.tmp 39 PID 2984 wrote to memory of 2940 2984 BC9B.tmp 39 PID 2940 wrote to memory of 2800 2940 BCE9.tmp 40 PID 2940 wrote to memory of 2800 2940 BCE9.tmp 40 PID 2940 wrote to memory of 2800 2940 BCE9.tmp 40 PID 2940 wrote to memory of 2800 2940 BCE9.tmp 40 PID 2800 wrote to memory of 2612 2800 BD47.tmp 41 PID 2800 wrote to memory of 2612 2800 BD47.tmp 41 PID 2800 wrote to memory of 2612 2800 BD47.tmp 41 PID 2800 wrote to memory of 2612 2800 BD47.tmp 41 PID 2612 wrote to memory of 2684 2612 BDB4.tmp 42 PID 2612 wrote to memory of 2684 2612 BDB4.tmp 42 PID 2612 wrote to memory of 2684 2612 BDB4.tmp 42 PID 2612 wrote to memory of 2684 2612 BDB4.tmp 42 PID 2684 wrote to memory of 2664 2684 BE21.tmp 43 PID 2684 wrote to memory of 2664 2684 BE21.tmp 43 PID 2684 wrote to memory of 2664 2684 BE21.tmp 43 PID 2684 wrote to memory of 2664 2684 BE21.tmp 43 PID 2664 wrote to memory of 680 2664 BE8E.tmp 44 PID 2664 wrote to memory of 680 2664 BE8E.tmp 44 PID 2664 wrote to memory of 680 2664 BE8E.tmp 44 PID 2664 wrote to memory of 680 2664 BE8E.tmp 44 PID 680 wrote to memory of 844 680 BEFB.tmp 45 PID 680 wrote to memory of 844 680 BEFB.tmp 45 PID 680 wrote to memory of 844 680 BEFB.tmp 45 PID 680 wrote to memory of 844 680 BEFB.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-20_4a77b35843a87552704bec58aaedb91f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\BB25.tmp"C:\Users\Admin\AppData\Local\Temp\BB25.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"C:\Users\Admin\AppData\Local\Temp\BDB4.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"C:\Users\Admin\AppData\Local\Temp\C6D8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"65⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"66⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"67⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"68⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"69⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"70⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"71⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"72⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"73⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"75⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"76⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"77⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"78⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"79⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"80⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"81⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"82⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"83⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"84⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"85⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"86⤵PID:108
-
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"87⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"88⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"89⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"90⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"91⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"92⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"93⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"94⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"95⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"96⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"97⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"98⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"99⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"100⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"101⤵PID:300
-
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"102⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"103⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"104⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"105⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"106⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"107⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"108⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\D78A.tmp"C:\Users\Admin\AppData\Local\Temp\D78A.tmp"109⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"C:\Users\Admin\AppData\Local\Temp\D7C9.tmp"110⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\D807.tmp"C:\Users\Admin\AppData\Local\Temp\D807.tmp"111⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\D845.tmp"C:\Users\Admin\AppData\Local\Temp\D845.tmp"112⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\D884.tmp"C:\Users\Admin\AppData\Local\Temp\D884.tmp"113⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"C:\Users\Admin\AppData\Local\Temp\D8C2.tmp"114⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\D901.tmp"C:\Users\Admin\AppData\Local\Temp\D901.tmp"115⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"116⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"117⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"118⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"119⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"120⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"121⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"C:\Users\Admin\AppData\Local\Temp\DAB5.tmp"122⤵PID:1852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-