Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
26/08/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe
-
Size
527KB
-
MD5
a62a27859c134979a69e87cc0a27d14f
-
SHA1
8862e802c4105036bdcf88855fa701d865dd2b68
-
SHA256
df749b13dcfb7caa1d09738207d08dbef5505fbd8a6834802244ba67e1479db5
-
SHA512
ddba5b945b66459e48bb3f8c66ecc9c149499b75b5aeffcbbcf35ac19e763f9ebb7cf235e01ca071130178e3b947ec93af5b4450b529e01f68b96fa4016dacce
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYTBzy9BXc6FTDaVImDH+Q+rrYvb+LIgMr5aBv:fU5rCOTeidim9W0PcI5AOMr5aGDZu
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2060 A61F.tmp 2912 A67C.tmp 1984 A709.tmp 2740 A776.tmp 1080 A7E3.tmp 2756 A850.tmp 2752 A8BD.tmp 2412 A91B.tmp 2804 A988.tmp 2580 A9F5.tmp 2664 AA72.tmp 2568 AAD0.tmp 2720 AB4D.tmp 760 ABAA.tmp 664 AC17.tmp 580 AC85.tmp 1376 ACE2.tmp 872 AD4F.tmp 2300 ADAD.tmp 592 AE0B.tmp 2208 AE78.tmp 1372 AEF5.tmp 2828 AF43.tmp 2284 AF81.tmp 2620 AFBF.tmp 2088 AFFE.tmp 2176 B03C.tmp 2152 B08A.tmp 2160 B0D8.tmp 2748 B117.tmp 1096 B155.tmp 1252 B193.tmp 2440 B1E1.tmp 1436 B220.tmp 1604 B25E.tmp 1636 B29D.tmp 1812 B2DB.tmp 1676 B319.tmp 3020 B358.tmp 1476 B396.tmp 908 B3D5.tmp 612 B413.tmp 272 B451.tmp 1756 B49F.tmp 2476 B4DE.tmp 2056 B51C.tmp 1400 B55B.tmp 3068 B599.tmp 556 B5D7.tmp 2132 B616.tmp 880 B654.tmp 1136 B693.tmp 2324 B6D1.tmp 1588 B70F.tmp 2820 B75D.tmp 2924 B79C.tmp 2976 B7DA.tmp 2860 B819.tmp 2644 B867.tmp 2660 B8A5.tmp 2744 B8F3.tmp 2776 B960.tmp 2788 B99F.tmp 2560 B9DD.tmp -
Loads dropped DLL 64 IoCs
pid Process 2324 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 2060 A61F.tmp 2912 A67C.tmp 1984 A709.tmp 2740 A776.tmp 1080 A7E3.tmp 2756 A850.tmp 2752 A8BD.tmp 2412 A91B.tmp 2804 A988.tmp 2580 A9F5.tmp 2664 AA72.tmp 2568 AAD0.tmp 2720 AB4D.tmp 760 ABAA.tmp 664 AC17.tmp 580 AC85.tmp 1376 ACE2.tmp 872 AD4F.tmp 2300 ADAD.tmp 592 AE0B.tmp 2208 AE78.tmp 1372 AEF5.tmp 2828 AF43.tmp 2284 AF81.tmp 2620 AFBF.tmp 2088 AFFE.tmp 2176 B03C.tmp 2152 B08A.tmp 2160 B0D8.tmp 2748 B117.tmp 1096 B155.tmp 1252 B193.tmp 2440 B1E1.tmp 1436 B220.tmp 1604 B25E.tmp 1636 B29D.tmp 1812 B2DB.tmp 1676 B319.tmp 3020 B358.tmp 1476 B396.tmp 908 B3D5.tmp 612 B413.tmp 272 B451.tmp 1756 B49F.tmp 2476 B4DE.tmp 2056 B51C.tmp 1400 B55B.tmp 3068 B599.tmp 556 B5D7.tmp 2132 B616.tmp 880 B654.tmp 1136 B693.tmp 2324 B6D1.tmp 1588 B70F.tmp 2820 B75D.tmp 2924 B79C.tmp 2976 B7DA.tmp 2860 B819.tmp 2644 B867.tmp 2660 B8A5.tmp 2744 B8F3.tmp 2776 B960.tmp 2788 B99F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C40A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E080.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F038.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7436.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8852.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 139.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 483.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 256B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 931B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A7E4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E7A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC33.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBDE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 227E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4135.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C755.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECBF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4431.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B66.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2060 2324 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 30 PID 2324 wrote to memory of 2060 2324 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 30 PID 2324 wrote to memory of 2060 2324 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 30 PID 2324 wrote to memory of 2060 2324 2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe 30 PID 2060 wrote to memory of 2912 2060 A61F.tmp 31 PID 2060 wrote to memory of 2912 2060 A61F.tmp 31 PID 2060 wrote to memory of 2912 2060 A61F.tmp 31 PID 2060 wrote to memory of 2912 2060 A61F.tmp 31 PID 2912 wrote to memory of 1984 2912 A67C.tmp 32 PID 2912 wrote to memory of 1984 2912 A67C.tmp 32 PID 2912 wrote to memory of 1984 2912 A67C.tmp 32 PID 2912 wrote to memory of 1984 2912 A67C.tmp 32 PID 1984 wrote to memory of 2740 1984 A709.tmp 33 PID 1984 wrote to memory of 2740 1984 A709.tmp 33 PID 1984 wrote to memory of 2740 1984 A709.tmp 33 PID 1984 wrote to memory of 2740 1984 A709.tmp 33 PID 2740 wrote to memory of 1080 2740 A776.tmp 34 PID 2740 wrote to memory of 1080 2740 A776.tmp 34 PID 2740 wrote to memory of 1080 2740 A776.tmp 34 PID 2740 wrote to memory of 1080 2740 A776.tmp 34 PID 1080 wrote to memory of 2756 1080 A7E3.tmp 35 PID 1080 wrote to memory of 2756 1080 A7E3.tmp 35 PID 1080 wrote to memory of 2756 1080 A7E3.tmp 35 PID 1080 wrote to memory of 2756 1080 A7E3.tmp 35 PID 2756 wrote to memory of 2752 2756 A850.tmp 36 PID 2756 wrote to memory of 2752 2756 A850.tmp 36 PID 2756 wrote to memory of 2752 2756 A850.tmp 36 PID 2756 wrote to memory of 2752 2756 A850.tmp 36 PID 2752 wrote to memory of 2412 2752 A8BD.tmp 37 PID 2752 wrote to memory of 2412 2752 A8BD.tmp 37 PID 2752 wrote to memory of 2412 2752 A8BD.tmp 37 PID 2752 wrote to memory of 2412 2752 A8BD.tmp 37 PID 2412 wrote to memory of 2804 2412 A91B.tmp 38 PID 2412 wrote to memory of 2804 2412 A91B.tmp 38 PID 2412 wrote to memory of 2804 2412 A91B.tmp 38 PID 2412 wrote to memory of 2804 2412 A91B.tmp 38 PID 2804 wrote to memory of 2580 2804 A988.tmp 39 PID 2804 wrote to memory of 2580 2804 A988.tmp 39 PID 2804 wrote to memory of 2580 2804 A988.tmp 39 PID 2804 wrote to memory of 2580 2804 A988.tmp 39 PID 2580 wrote to memory of 2664 2580 A9F5.tmp 40 PID 2580 wrote to memory of 2664 2580 A9F5.tmp 40 PID 2580 wrote to memory of 2664 2580 A9F5.tmp 40 PID 2580 wrote to memory of 2664 2580 A9F5.tmp 40 PID 2664 wrote to memory of 2568 2664 AA72.tmp 41 PID 2664 wrote to memory of 2568 2664 AA72.tmp 41 PID 2664 wrote to memory of 2568 2664 AA72.tmp 41 PID 2664 wrote to memory of 2568 2664 AA72.tmp 41 PID 2568 wrote to memory of 2720 2568 AAD0.tmp 42 PID 2568 wrote to memory of 2720 2568 AAD0.tmp 42 PID 2568 wrote to memory of 2720 2568 AAD0.tmp 42 PID 2568 wrote to memory of 2720 2568 AAD0.tmp 42 PID 2720 wrote to memory of 760 2720 AB4D.tmp 43 PID 2720 wrote to memory of 760 2720 AB4D.tmp 43 PID 2720 wrote to memory of 760 2720 AB4D.tmp 43 PID 2720 wrote to memory of 760 2720 AB4D.tmp 43 PID 760 wrote to memory of 664 760 ABAA.tmp 44 PID 760 wrote to memory of 664 760 ABAA.tmp 44 PID 760 wrote to memory of 664 760 ABAA.tmp 44 PID 760 wrote to memory of 664 760 ABAA.tmp 44 PID 664 wrote to memory of 580 664 AC17.tmp 45 PID 664 wrote to memory of 580 664 AC17.tmp 45 PID 664 wrote to memory of 580 664 AC17.tmp 45 PID 664 wrote to memory of 580 664 AC17.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_a62a27859c134979a69e87cc0a27d14f_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\A850.tmp"C:\Users\Admin\AppData\Local\Temp\A850.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\A91B.tmp"C:\Users\Admin\AppData\Local\Temp\A91B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\A988.tmp"C:\Users\Admin\AppData\Local\Temp\A988.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"C:\Users\Admin\AppData\Local\Temp\AAD0.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\AC85.tmp"C:\Users\Admin\AppData\Local\Temp\AC85.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\AE78.tmp"C:\Users\Admin\AppData\Local\Temp\AE78.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"C:\Users\Admin\AppData\Local\Temp\B0D8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B155.tmp"C:\Users\Admin\AppData\Local\Temp\B155.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\B358.tmp"C:\Users\Admin\AppData\Local\Temp\B358.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B396.tmp"C:\Users\Admin\AppData\Local\Temp\B396.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\B413.tmp"C:\Users\Admin\AppData\Local\Temp\B413.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:612 -
C:\Users\Admin\AppData\Local\Temp\B451.tmp"C:\Users\Admin\AppData\Local\Temp\B451.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:556 -
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\B70F.tmp"C:\Users\Admin\AppData\Local\Temp\B70F.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"65⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"C:\Users\Admin\AppData\Local\Temp\BA2B.tmp"66⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"67⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"68⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"69⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"70⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"71⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"72⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"73⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"C:\Users\Admin\AppData\Local\Temp\BC3D.tmp"74⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"C:\Users\Admin\AppData\Local\Temp\BC7C.tmp"75⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"C:\Users\Admin\AppData\Local\Temp\BCBA.tmp"76⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"77⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"78⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"79⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"80⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"81⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"82⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"83⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\BECD.tmp"C:\Users\Admin\AppData\Local\Temp\BECD.tmp"84⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"86⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"87⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"C:\Users\Admin\AppData\Local\Temp\BFC6.tmp"88⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"89⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"90⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"91⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"92⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"C:\Users\Admin\AppData\Local\Temp\C0FE.tmp"93⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\C13D.tmp"C:\Users\Admin\AppData\Local\Temp\C13D.tmp"94⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"95⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"C:\Users\Admin\AppData\Local\Temp\C1B9.tmp"96⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"97⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\C236.tmp"C:\Users\Admin\AppData\Local\Temp\C236.tmp"98⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"99⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"100⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"101⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"102⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"103⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"104⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"106⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"107⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"108⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"109⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"110⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"111⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"C:\Users\Admin\AppData\Local\Temp\C5CF.tmp"112⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\C60D.tmp"C:\Users\Admin\AppData\Local\Temp\C60D.tmp"113⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"114⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"115⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"116⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"117⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C793.tmp"C:\Users\Admin\AppData\Local\Temp\C793.tmp"119⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"120⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\C810.tmp"C:\Users\Admin\AppData\Local\Temp\C810.tmp"121⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"122⤵PID:1452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-