Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 11:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe
-
Size
541KB
-
MD5
6d7c71907b6ebcf76edcffab2ba21e18
-
SHA1
842d10f834037d44283ee452f02eefde3adea513
-
SHA256
04041a869faaf08b02a5398ebcdcc63ab92b228a2b16573d4318089170ebab6c
-
SHA512
3270b738269c2eef92d2ea8aef053d6c6acba8711241afc0ff41a9b361e86a08f43ba391acaedf092c4adb804ef24b588cb4b9dcb03054b1f12b01da586e9727
-
SSDEEP
12288:UU5rCOTeif2bkRnEOZWgHrp5KqvyqTY6rvrZa73ctO:UUQOJf2a1ZNd5Fy0rU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2288 A18D.tmp 2252 A1EA.tmp 1180 A248.tmp 2164 A2B5.tmp 2916 A332.tmp 2808 A38F.tmp 2160 A3DD.tmp 2688 A43B.tmp 2796 A499.tmp 2660 A4F6.tmp 2736 A563.tmp 2032 A5C1.tmp 680 A62E.tmp 3008 A69B.tmp 2700 A709.tmp 1644 A776.tmp 2936 A7D3.tmp 2540 A850.tmp 1396 A8AE.tmp 540 A91B.tmp 2648 A979.tmp 2844 A9E6.tmp 1436 AA53.tmp 892 AAA1.tmp 1612 AADF.tmp 1764 AB2D.tmp 2064 AB6C.tmp 1092 ABBA.tmp 572 ABF8.tmp 2380 AC37.tmp 2520 AC75.tmp 2360 ACB3.tmp 996 ACF2.tmp 2840 AD40.tmp 816 AD7E.tmp 1856 ADBD.tmp 2112 ADFB.tmp 1748 AE59.tmp 2192 AEA7.tmp 1800 AEE5.tmp 784 AF33.tmp 1360 AF81.tmp 1784 AFBF.tmp 2204 B00D.tmp 1320 B04C.tmp 1984 B08A.tmp 2232 B0D8.tmp 876 B117.tmp 2440 B155.tmp 1976 B193.tmp 1740 B1D2.tmp 2244 B210.tmp 1712 B24F.tmp 1580 B28D.tmp 2596 B30A.tmp 2584 B348.tmp 3056 B387.tmp 2800 B3C5.tmp 2764 B413.tmp 2364 B451.tmp 2904 B49F.tmp 2768 B4ED.tmp 1932 B52C.tmp 3068 B56A.tmp -
Loads dropped DLL 64 IoCs
pid Process 2220 2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe 2288 A18D.tmp 2252 A1EA.tmp 1180 A248.tmp 2164 A2B5.tmp 2916 A332.tmp 2808 A38F.tmp 2160 A3DD.tmp 2688 A43B.tmp 2796 A499.tmp 2660 A4F6.tmp 2736 A563.tmp 2032 A5C1.tmp 680 A62E.tmp 3008 A69B.tmp 2700 A709.tmp 1644 A776.tmp 2936 A7D3.tmp 2540 A850.tmp 1396 A8AE.tmp 540 A91B.tmp 2648 A979.tmp 2844 A9E6.tmp 1436 AA53.tmp 892 AAA1.tmp 1612 AADF.tmp 1764 AB2D.tmp 2064 AB6C.tmp 1092 ABBA.tmp 572 ABF8.tmp 2380 AC37.tmp 2520 AC75.tmp 2360 ACB3.tmp 996 ACF2.tmp 2840 AD40.tmp 816 AD7E.tmp 1856 ADBD.tmp 2112 ADFB.tmp 1748 AE59.tmp 2192 AEA7.tmp 1800 AEE5.tmp 784 AF33.tmp 1360 AF81.tmp 1784 AFBF.tmp 2204 B00D.tmp 1320 B04C.tmp 1984 B08A.tmp 2232 B0D8.tmp 876 B117.tmp 2440 B155.tmp 1976 B193.tmp 1740 B1D2.tmp 2244 B210.tmp 1712 B24F.tmp 1580 B28D.tmp 2596 B30A.tmp 2584 B348.tmp 3056 B387.tmp 2800 B3C5.tmp 2764 B413.tmp 2364 B451.tmp 2904 B49F.tmp 2768 B4ED.tmp 1932 B52C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9849.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E83D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3727.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1574.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F180.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 451B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 753F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A979.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D817.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 625B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BAB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D549.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F43E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 170A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 277E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2288 2220 2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe 30 PID 2220 wrote to memory of 2288 2220 2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe 30 PID 2220 wrote to memory of 2288 2220 2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe 30 PID 2220 wrote to memory of 2288 2220 2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe 30 PID 2288 wrote to memory of 2252 2288 A18D.tmp 31 PID 2288 wrote to memory of 2252 2288 A18D.tmp 31 PID 2288 wrote to memory of 2252 2288 A18D.tmp 31 PID 2288 wrote to memory of 2252 2288 A18D.tmp 31 PID 2252 wrote to memory of 1180 2252 A1EA.tmp 32 PID 2252 wrote to memory of 1180 2252 A1EA.tmp 32 PID 2252 wrote to memory of 1180 2252 A1EA.tmp 32 PID 2252 wrote to memory of 1180 2252 A1EA.tmp 32 PID 1180 wrote to memory of 2164 1180 A248.tmp 33 PID 1180 wrote to memory of 2164 1180 A248.tmp 33 PID 1180 wrote to memory of 2164 1180 A248.tmp 33 PID 1180 wrote to memory of 2164 1180 A248.tmp 33 PID 2164 wrote to memory of 2916 2164 A2B5.tmp 34 PID 2164 wrote to memory of 2916 2164 A2B5.tmp 34 PID 2164 wrote to memory of 2916 2164 A2B5.tmp 34 PID 2164 wrote to memory of 2916 2164 A2B5.tmp 34 PID 2916 wrote to memory of 2808 2916 A332.tmp 35 PID 2916 wrote to memory of 2808 2916 A332.tmp 35 PID 2916 wrote to memory of 2808 2916 A332.tmp 35 PID 2916 wrote to memory of 2808 2916 A332.tmp 35 PID 2808 wrote to memory of 2160 2808 A38F.tmp 36 PID 2808 wrote to memory of 2160 2808 A38F.tmp 36 PID 2808 wrote to memory of 2160 2808 A38F.tmp 36 PID 2808 wrote to memory of 2160 2808 A38F.tmp 36 PID 2160 wrote to memory of 2688 2160 A3DD.tmp 37 PID 2160 wrote to memory of 2688 2160 A3DD.tmp 37 PID 2160 wrote to memory of 2688 2160 A3DD.tmp 37 PID 2160 wrote to memory of 2688 2160 A3DD.tmp 37 PID 2688 wrote to memory of 2796 2688 A43B.tmp 38 PID 2688 wrote to memory of 2796 2688 A43B.tmp 38 PID 2688 wrote to memory of 2796 2688 A43B.tmp 38 PID 2688 wrote to memory of 2796 2688 A43B.tmp 38 PID 2796 wrote to memory of 2660 2796 A499.tmp 39 PID 2796 wrote to memory of 2660 2796 A499.tmp 39 PID 2796 wrote to memory of 2660 2796 A499.tmp 39 PID 2796 wrote to memory of 2660 2796 A499.tmp 39 PID 2660 wrote to memory of 2736 2660 A4F6.tmp 40 PID 2660 wrote to memory of 2736 2660 A4F6.tmp 40 PID 2660 wrote to memory of 2736 2660 A4F6.tmp 40 PID 2660 wrote to memory of 2736 2660 A4F6.tmp 40 PID 2736 wrote to memory of 2032 2736 A563.tmp 41 PID 2736 wrote to memory of 2032 2736 A563.tmp 41 PID 2736 wrote to memory of 2032 2736 A563.tmp 41 PID 2736 wrote to memory of 2032 2736 A563.tmp 41 PID 2032 wrote to memory of 680 2032 A5C1.tmp 42 PID 2032 wrote to memory of 680 2032 A5C1.tmp 42 PID 2032 wrote to memory of 680 2032 A5C1.tmp 42 PID 2032 wrote to memory of 680 2032 A5C1.tmp 42 PID 680 wrote to memory of 3008 680 A62E.tmp 43 PID 680 wrote to memory of 3008 680 A62E.tmp 43 PID 680 wrote to memory of 3008 680 A62E.tmp 43 PID 680 wrote to memory of 3008 680 A62E.tmp 43 PID 3008 wrote to memory of 2700 3008 A69B.tmp 44 PID 3008 wrote to memory of 2700 3008 A69B.tmp 44 PID 3008 wrote to memory of 2700 3008 A69B.tmp 44 PID 3008 wrote to memory of 2700 3008 A69B.tmp 44 PID 2700 wrote to memory of 1644 2700 A709.tmp 45 PID 2700 wrote to memory of 1644 2700 A709.tmp 45 PID 2700 wrote to memory of 1644 2700 A709.tmp 45 PID 2700 wrote to memory of 1644 2700 A709.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_6d7c71907b6ebcf76edcffab2ba21e18_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\A62E.tmp"C:\Users\Admin\AppData\Local\Temp\A62E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"C:\Users\Admin\AppData\Local\Temp\ABBA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\AC37.tmp"C:\Users\Admin\AppData\Local\Temp\AC37.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"C:\Users\Admin\AppData\Local\Temp\ACB3.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"C:\Users\Admin\AppData\Local\Temp\AD7E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:816 -
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"C:\Users\Admin\AppData\Local\Temp\ADFB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\B210.tmp"C:\Users\Admin\AppData\Local\Temp\B210.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\B28D.tmp"C:\Users\Admin\AppData\Local\Temp\B28D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\B30A.tmp"C:\Users\Admin\AppData\Local\Temp\B30A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\B387.tmp"C:\Users\Admin\AppData\Local\Temp\B387.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"C:\Users\Admin\AppData\Local\Temp\B3C5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"65⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"66⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"67⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"68⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"69⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"70⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"71⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"72⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"73⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"74⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"75⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"76⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"77⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"78⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"79⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"80⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"81⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"82⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"83⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"84⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"85⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"86⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"87⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"88⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"89⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"90⤵
- System Location Discovery: System Language Discovery
PID:692 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"91⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"C:\Users\Admin\AppData\Local\Temp\BC1E.tmp"92⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"93⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"C:\Users\Admin\AppData\Local\Temp\BC9B.tmp"94⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"C:\Users\Admin\AppData\Local\Temp\BCD9.tmp"95⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"96⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\BD56.tmp"C:\Users\Admin\AppData\Local\Temp\BD56.tmp"97⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"98⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"C:\Users\Admin\AppData\Local\Temp\BDD3.tmp"99⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"100⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp"C:\Users\Admin\AppData\Local\Temp\BE50.tmp"101⤵PID:564
-
C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"C:\Users\Admin\AppData\Local\Temp\BE8E.tmp"102⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"103⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"104⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"105⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"106⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"107⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"108⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"110⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"111⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"112⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"113⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"114⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"115⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"116⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"117⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"118⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"119⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"120⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\C39D.tmp"C:\Users\Admin\AppData\Local\Temp\C39D.tmp"121⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"C:\Users\Admin\AppData\Local\Temp\C3DB.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-