Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
01/09/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe
-
Size
765KB
-
MD5
d8b079b42acfa9631cb8507eea378bfc
-
SHA1
980b34b81660794daf06569c79bd0a158a7b3a6e
-
SHA256
399ede95505438bd6d484d2e00acc78e3ece9416b9732ac7714739a56148b69a
-
SHA512
2f4a93f8eb782e8954fd6d1cb7d528f92d1f55919d12076696e6b4e9b4d8a0776e0152d3ff624eab2945e6af72950de05216c122500c500eb097f77d8b17edf4
-
SSDEEP
12288:ZU5rCOTeiDaFHpJ1PQ4cg+Y7fcZJ783ZF5rn5rLOa54U5w5A:ZUQOJDGpJ1PQ4cj2fcTw3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2224 6078.tmp 2072 6114.tmp 2168 61B0.tmp 2828 622D.tmp 2880 627B.tmp 2988 62E8.tmp 2952 6355.tmp 688 63C2.tmp 2604 6420.tmp 2680 647D.tmp 2156 64BC.tmp 2548 64FA.tmp 808 6548.tmp 316 6587.tmp 1008 6680.tmp 3016 66DE.tmp 2376 672C.tmp 2936 677A.tmp 2848 67B8.tmp 2328 6806.tmp 2972 6873.tmp 1956 6900.tmp 2916 694E.tmp 548 698C.tmp 1796 69CB.tmp 2352 6A19.tmp 2136 6A57.tmp 1808 6A95.tmp 2340 6AD4.tmp 2228 6B12.tmp 2324 6B51.tmp 956 6B8F.tmp 1492 6BCD.tmp 1108 6C0C.tmp 2220 6C4A.tmp 932 6C89.tmp 1052 6CC7.tmp 1272 6D05.tmp 560 6D44.tmp 1668 6D82.tmp 3028 6DC1.tmp 848 6DFF.tmp 2488 6E3D.tmp 1688 6E7C.tmp 2392 6EBA.tmp 3052 6EF9.tmp 1764 6F37.tmp 992 6F75.tmp 2036 6FB4.tmp 2032 6FF2.tmp 884 7031.tmp 296 706F.tmp 2792 70AD.tmp 1704 70EC.tmp 2696 712A.tmp 2732 7169.tmp 2248 71A7.tmp 2760 71E5.tmp 2708 7224.tmp 2832 7262.tmp 2880 72B0.tmp 2988 72FE.tmp 2952 733D.tmp 2864 73B9.tmp -
Loads dropped DLL 64 IoCs
pid Process 2404 2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe 2224 6078.tmp 2072 6114.tmp 2168 61B0.tmp 2828 622D.tmp 2880 627B.tmp 2988 62E8.tmp 2952 6355.tmp 688 63C2.tmp 2604 6420.tmp 2680 647D.tmp 2156 64BC.tmp 2548 64FA.tmp 808 6548.tmp 316 6587.tmp 1008 6680.tmp 3016 66DE.tmp 2376 672C.tmp 2936 677A.tmp 2848 67B8.tmp 2328 6806.tmp 2972 6873.tmp 1956 6900.tmp 2916 694E.tmp 548 698C.tmp 1796 69CB.tmp 2352 6A19.tmp 2136 6A57.tmp 1808 6A95.tmp 2340 6AD4.tmp 2228 6B12.tmp 2324 6B51.tmp 956 6B8F.tmp 1492 6BCD.tmp 1108 6C0C.tmp 2220 6C4A.tmp 932 6C89.tmp 1052 6CC7.tmp 1272 6D05.tmp 560 6D44.tmp 1668 6D82.tmp 3028 6DC1.tmp 848 6DFF.tmp 2488 6E3D.tmp 1688 6E7C.tmp 2392 6EBA.tmp 3052 6EF9.tmp 1764 6F37.tmp 992 6F75.tmp 2036 6FB4.tmp 2032 6FF2.tmp 884 7031.tmp 296 706F.tmp 2792 70AD.tmp 1704 70EC.tmp 2696 712A.tmp 2732 7169.tmp 2248 71A7.tmp 2760 71E5.tmp 2708 7224.tmp 2832 7262.tmp 2880 72B0.tmp 2988 72FE.tmp 2952 733D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F325.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A370.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61DF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C005.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4B81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 386E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B126.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A479.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2224 2404 2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe 30 PID 2404 wrote to memory of 2224 2404 2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe 30 PID 2404 wrote to memory of 2224 2404 2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe 30 PID 2404 wrote to memory of 2224 2404 2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe 30 PID 2224 wrote to memory of 2072 2224 6078.tmp 31 PID 2224 wrote to memory of 2072 2224 6078.tmp 31 PID 2224 wrote to memory of 2072 2224 6078.tmp 31 PID 2224 wrote to memory of 2072 2224 6078.tmp 31 PID 2072 wrote to memory of 2168 2072 6114.tmp 32 PID 2072 wrote to memory of 2168 2072 6114.tmp 32 PID 2072 wrote to memory of 2168 2072 6114.tmp 32 PID 2072 wrote to memory of 2168 2072 6114.tmp 32 PID 2168 wrote to memory of 2828 2168 61B0.tmp 33 PID 2168 wrote to memory of 2828 2168 61B0.tmp 33 PID 2168 wrote to memory of 2828 2168 61B0.tmp 33 PID 2168 wrote to memory of 2828 2168 61B0.tmp 33 PID 2828 wrote to memory of 2880 2828 622D.tmp 34 PID 2828 wrote to memory of 2880 2828 622D.tmp 34 PID 2828 wrote to memory of 2880 2828 622D.tmp 34 PID 2828 wrote to memory of 2880 2828 622D.tmp 34 PID 2880 wrote to memory of 2988 2880 627B.tmp 35 PID 2880 wrote to memory of 2988 2880 627B.tmp 35 PID 2880 wrote to memory of 2988 2880 627B.tmp 35 PID 2880 wrote to memory of 2988 2880 627B.tmp 35 PID 2988 wrote to memory of 2952 2988 62E8.tmp 36 PID 2988 wrote to memory of 2952 2988 62E8.tmp 36 PID 2988 wrote to memory of 2952 2988 62E8.tmp 36 PID 2988 wrote to memory of 2952 2988 62E8.tmp 36 PID 2952 wrote to memory of 688 2952 6355.tmp 37 PID 2952 wrote to memory of 688 2952 6355.tmp 37 PID 2952 wrote to memory of 688 2952 6355.tmp 37 PID 2952 wrote to memory of 688 2952 6355.tmp 37 PID 688 wrote to memory of 2604 688 63C2.tmp 38 PID 688 wrote to memory of 2604 688 63C2.tmp 38 PID 688 wrote to memory of 2604 688 63C2.tmp 38 PID 688 wrote to memory of 2604 688 63C2.tmp 38 PID 2604 wrote to memory of 2680 2604 6420.tmp 39 PID 2604 wrote to memory of 2680 2604 6420.tmp 39 PID 2604 wrote to memory of 2680 2604 6420.tmp 39 PID 2604 wrote to memory of 2680 2604 6420.tmp 39 PID 2680 wrote to memory of 2156 2680 647D.tmp 40 PID 2680 wrote to memory of 2156 2680 647D.tmp 40 PID 2680 wrote to memory of 2156 2680 647D.tmp 40 PID 2680 wrote to memory of 2156 2680 647D.tmp 40 PID 2156 wrote to memory of 2548 2156 64BC.tmp 41 PID 2156 wrote to memory of 2548 2156 64BC.tmp 41 PID 2156 wrote to memory of 2548 2156 64BC.tmp 41 PID 2156 wrote to memory of 2548 2156 64BC.tmp 41 PID 2548 wrote to memory of 808 2548 64FA.tmp 42 PID 2548 wrote to memory of 808 2548 64FA.tmp 42 PID 2548 wrote to memory of 808 2548 64FA.tmp 42 PID 2548 wrote to memory of 808 2548 64FA.tmp 42 PID 808 wrote to memory of 316 808 6548.tmp 43 PID 808 wrote to memory of 316 808 6548.tmp 43 PID 808 wrote to memory of 316 808 6548.tmp 43 PID 808 wrote to memory of 316 808 6548.tmp 43 PID 316 wrote to memory of 1008 316 6587.tmp 44 PID 316 wrote to memory of 1008 316 6587.tmp 44 PID 316 wrote to memory of 1008 316 6587.tmp 44 PID 316 wrote to memory of 1008 316 6587.tmp 44 PID 1008 wrote to memory of 3016 1008 6680.tmp 45 PID 1008 wrote to memory of 3016 1008 6680.tmp 45 PID 1008 wrote to memory of 3016 1008 6680.tmp 45 PID 1008 wrote to memory of 3016 1008 6680.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-01_d8b079b42acfa9631cb8507eea378bfc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\6114.tmp"C:\Users\Admin\AppData\Local\Temp\6114.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\627B.tmp"C:\Users\Admin\AppData\Local\Temp\627B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\6355.tmp"C:\Users\Admin\AppData\Local\Temp\6355.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\647D.tmp"C:\Users\Admin\AppData\Local\Temp\647D.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\64BC.tmp"C:\Users\Admin\AppData\Local\Temp\64BC.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\64FA.tmp"C:\Users\Admin\AppData\Local\Temp\64FA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\6548.tmp"C:\Users\Admin\AppData\Local\Temp\6548.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Users\Admin\AppData\Local\Temp\6587.tmp"C:\Users\Admin\AppData\Local\Temp\6587.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\6680.tmp"C:\Users\Admin\AppData\Local\Temp\6680.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\672C.tmp"C:\Users\Admin\AppData\Local\Temp\672C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\677A.tmp"C:\Users\Admin\AppData\Local\Temp\677A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\67B8.tmp"C:\Users\Admin\AppData\Local\Temp\67B8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6806.tmp"C:\Users\Admin\AppData\Local\Temp\6806.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\6873.tmp"C:\Users\Admin\AppData\Local\Temp\6873.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\6900.tmp"C:\Users\Admin\AppData\Local\Temp\6900.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\698C.tmp"C:\Users\Admin\AppData\Local\Temp\698C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:548 -
C:\Users\Admin\AppData\Local\Temp\69CB.tmp"C:\Users\Admin\AppData\Local\Temp\69CB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\6B51.tmp"C:\Users\Admin\AppData\Local\Temp\6B51.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"C:\Users\Admin\AppData\Local\Temp\6B8F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"C:\Users\Admin\AppData\Local\Temp\6BCD.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"C:\Users\Admin\AppData\Local\Temp\6C0C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"C:\Users\Admin\AppData\Local\Temp\6C4A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\6C89.tmp"C:\Users\Admin\AppData\Local\Temp\6C89.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"C:\Users\Admin\AppData\Local\Temp\6CC7.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\6D05.tmp"C:\Users\Admin\AppData\Local\Temp\6D05.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\6D82.tmp"C:\Users\Admin\AppData\Local\Temp\6D82.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"C:\Users\Admin\AppData\Local\Temp\6E3D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"C:\Users\Admin\AppData\Local\Temp\6E7C.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"C:\Users\Admin\AppData\Local\Temp\6EBA.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"C:\Users\Admin\AppData\Local\Temp\6FB4.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\7031.tmp"C:\Users\Admin\AppData\Local\Temp\7031.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\706F.tmp"C:\Users\Admin\AppData\Local\Temp\706F.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\70AD.tmp"C:\Users\Admin\AppData\Local\Temp\70AD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\71E5.tmp"C:\Users\Admin\AppData\Local\Temp\71E5.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\72FE.tmp"C:\Users\Admin\AppData\Local\Temp\72FE.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\733D.tmp"C:\Users\Admin\AppData\Local\Temp\733D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"65⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"66⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"68⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"69⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"70⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\75DB.tmp"C:\Users\Admin\AppData\Local\Temp\75DB.tmp"71⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"72⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"73⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\7704.tmp"C:\Users\Admin\AppData\Local\Temp\7704.tmp"74⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"75⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\77BF.tmp"C:\Users\Admin\AppData\Local\Temp\77BF.tmp"76⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\780D.tmp"C:\Users\Admin\AppData\Local\Temp\780D.tmp"77⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\784B.tmp"C:\Users\Admin\AppData\Local\Temp\784B.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"79⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\78C8.tmp"C:\Users\Admin\AppData\Local\Temp\78C8.tmp"80⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"81⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\7935.tmp"C:\Users\Admin\AppData\Local\Temp\7935.tmp"82⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"83⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\79B2.tmp"C:\Users\Admin\AppData\Local\Temp\79B2.tmp"84⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\79F1.tmp"C:\Users\Admin\AppData\Local\Temp\79F1.tmp"85⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"86⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"87⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"C:\Users\Admin\AppData\Local\Temp\7AAC.tmp"88⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"89⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"90⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"91⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"C:\Users\Admin\AppData\Local\Temp\7BA5.tmp"92⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"C:\Users\Admin\AppData\Local\Temp\7BE4.tmp"93⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\7C22.tmp"C:\Users\Admin\AppData\Local\Temp\7C22.tmp"94⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\7C61.tmp"C:\Users\Admin\AppData\Local\Temp\7C61.tmp"95⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"96⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"97⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"C:\Users\Admin\AppData\Local\Temp\7D0C.tmp"98⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"99⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\7D89.tmp"C:\Users\Admin\AppData\Local\Temp\7D89.tmp"100⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"C:\Users\Admin\AppData\Local\Temp\7DC7.tmp"101⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\7E06.tmp"C:\Users\Admin\AppData\Local\Temp\7E06.tmp"102⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\7E44.tmp"C:\Users\Admin\AppData\Local\Temp\7E44.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\7E83.tmp"C:\Users\Admin\AppData\Local\Temp\7E83.tmp"104⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"C:\Users\Admin\AppData\Local\Temp\7EC1.tmp"105⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"C:\Users\Admin\AppData\Local\Temp\7EFF.tmp"106⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"C:\Users\Admin\AppData\Local\Temp\7F3E.tmp"107⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"C:\Users\Admin\AppData\Local\Temp\7F6D.tmp"108⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"C:\Users\Admin\AppData\Local\Temp\7FAB.tmp"109⤵PID:824
-
C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"C:\Users\Admin\AppData\Local\Temp\7FE9.tmp"110⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\8028.tmp"C:\Users\Admin\AppData\Local\Temp\8028.tmp"111⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\8066.tmp"C:\Users\Admin\AppData\Local\Temp\8066.tmp"112⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"113⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"114⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"115⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"116⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\817F.tmp"C:\Users\Admin\AppData\Local\Temp\817F.tmp"117⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\81CD.tmp"C:\Users\Admin\AppData\Local\Temp\81CD.tmp"118⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"119⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8279.tmp"C:\Users\Admin\AppData\Local\Temp\8279.tmp"120⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"121⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\8343.tmp"C:\Users\Admin\AppData\Local\Temp\8343.tmp"122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-