Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe
-
Size
486KB
-
MD5
8a1e70d3b70164431b7ff3a40cb22c26
-
SHA1
765849a25d3a59479c9b6451b5e9e872f43a394f
-
SHA256
f774ee1e4f67110c3e3ee294ca8a675df190f62736a2258ba2d593143b08eea9
-
SHA512
7c718737b53410aab14d5070743fee858071f42fa28199213ef9814bcd925a630d0257161a063773966f4f916960bdcc53e0f26318c86a042d18d2d79b4891e8
-
SSDEEP
12288:/U5rCOTeiDUEsz7Pf/oF/AsRhhSQosq8v25NZ:/UQOJDGz7P4F/xtSMq8SN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 380 C6B9.tmp 484 C716.tmp 2368 C783.tmp 2756 C7F1.tmp 2964 C86D.tmp 3052 C8CB.tmp 2940 C938.tmp 2932 C9B5.tmp 2824 CA22.tmp 2440 CA8F.tmp 2716 CAED.tmp 2696 CB6A.tmp 1172 CBD7.tmp 2388 CC44.tmp 2272 CCC1.tmp 1452 CD2E.tmp 2868 CD8C.tmp 436 CDF9.tmp 1252 CE76.tmp 2896 CEF3.tmp 1740 CF60.tmp 2752 CFCD.tmp 2444 D02B.tmp 276 D079.tmp 1168 D0B7.tmp 2128 D0F5.tmp 1912 D134.tmp 2832 D172.tmp 2176 D1B1.tmp 1228 D1EF.tmp 864 D22E.tmp 2112 D26C.tmp 1924 D2AA.tmp 884 D2E9.tmp 2492 D327.tmp 2592 D375.tmp 2012 D3B4.tmp 468 D3F2.tmp 2268 D430.tmp 1812 D47E.tmp 2288 D4BD.tmp 536 D4FB.tmp 1712 D53A.tmp 1844 D578.tmp 1984 D5B6.tmp 1956 D5F5.tmp 2448 D633.tmp 2480 D672.tmp 1304 D6B0.tmp 856 D6EE.tmp 1520 D72D.tmp 2300 D76B.tmp 1628 D7AA.tmp 1724 D7E8.tmp 1484 D826.tmp 2744 D865.tmp 2392 D8A3.tmp 2560 D8E2.tmp 2908 D920.tmp 2960 D95E.tmp 2800 D99D.tmp 2988 D9EB.tmp 2956 DA29.tmp 2972 DA68.tmp -
Loads dropped DLL 64 IoCs
pid Process 2296 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 380 C6B9.tmp 484 C716.tmp 2368 C783.tmp 2756 C7F1.tmp 2964 C86D.tmp 3052 C8CB.tmp 2940 C938.tmp 2932 C9B5.tmp 2824 CA22.tmp 2440 CA8F.tmp 2716 CAED.tmp 2696 CB6A.tmp 1172 CBD7.tmp 2388 CC44.tmp 2272 CCC1.tmp 1452 CD2E.tmp 2868 CD8C.tmp 436 CDF9.tmp 1252 CE76.tmp 2896 CEF3.tmp 1740 CF60.tmp 2752 CFCD.tmp 2444 D02B.tmp 276 D079.tmp 1168 D0B7.tmp 2128 D0F5.tmp 1912 D134.tmp 2832 D172.tmp 2176 D1B1.tmp 1228 D1EF.tmp 864 D22E.tmp 2112 D26C.tmp 1924 D2AA.tmp 884 D2E9.tmp 2492 D327.tmp 2592 D375.tmp 2012 D3B4.tmp 468 D3F2.tmp 2268 D430.tmp 1812 D47E.tmp 2288 D4BD.tmp 536 D4FB.tmp 1712 D53A.tmp 1844 D578.tmp 1984 D5B6.tmp 1956 D5F5.tmp 2448 D633.tmp 2480 D672.tmp 1304 D6B0.tmp 856 D6EE.tmp 1520 D72D.tmp 2300 D76B.tmp 1628 D7AA.tmp 1724 D7E8.tmp 1484 D826.tmp 2744 D865.tmp 2392 D8A3.tmp 2560 D8E2.tmp 2908 D920.tmp 2960 D95E.tmp 2800 D99D.tmp 2988 D9EB.tmp 2956 DA29.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED0D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 761A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C33F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E24.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AFB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 628A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BF59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 707F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5725.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B78C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2CDA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 365C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 37A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5FDC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C18B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 420F.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2296 wrote to memory of 380 2296 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 30 PID 2296 wrote to memory of 380 2296 2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe 30 PID 380 wrote to memory of 484 380 C6B9.tmp 31 PID 380 wrote to memory of 484 380 C6B9.tmp 31 PID 380 wrote to memory of 484 380 C6B9.tmp 31 PID 380 wrote to memory of 484 380 C6B9.tmp 31 PID 484 wrote to memory of 2368 484 C716.tmp 32 PID 484 wrote to memory of 2368 484 C716.tmp 32 PID 484 wrote to memory of 2368 484 C716.tmp 32 PID 484 wrote to memory of 2368 484 C716.tmp 32 PID 2368 wrote to memory of 2756 2368 C783.tmp 33 PID 2368 wrote to memory of 2756 2368 C783.tmp 33 PID 2368 wrote to memory of 2756 2368 C783.tmp 33 PID 2368 wrote to memory of 2756 2368 C783.tmp 33 PID 2756 wrote to memory of 2964 2756 C7F1.tmp 34 PID 2756 wrote to memory of 2964 2756 C7F1.tmp 34 PID 2756 wrote to memory of 2964 2756 C7F1.tmp 34 PID 2756 wrote to memory of 2964 2756 C7F1.tmp 34 PID 2964 wrote to memory of 3052 2964 C86D.tmp 35 PID 2964 wrote to memory of 3052 2964 C86D.tmp 35 PID 2964 wrote to memory of 3052 2964 C86D.tmp 35 PID 2964 wrote to memory of 3052 2964 C86D.tmp 35 PID 3052 wrote to memory of 2940 3052 C8CB.tmp 36 PID 3052 wrote to memory of 2940 3052 C8CB.tmp 36 PID 3052 wrote to memory of 2940 3052 C8CB.tmp 36 PID 3052 wrote to memory of 2940 3052 C8CB.tmp 36 PID 2940 wrote to memory of 2932 2940 C938.tmp 37 PID 2940 wrote to memory of 2932 2940 C938.tmp 37 PID 2940 wrote to memory of 2932 2940 C938.tmp 37 PID 2940 wrote to memory of 2932 2940 C938.tmp 37 PID 2932 wrote to memory of 2824 2932 C9B5.tmp 38 PID 2932 wrote to memory of 2824 2932 C9B5.tmp 38 PID 2932 wrote to memory of 2824 2932 C9B5.tmp 38 PID 2932 wrote to memory of 2824 2932 C9B5.tmp 38 PID 2824 wrote to memory of 2440 2824 CA22.tmp 39 PID 2824 wrote to memory of 2440 2824 CA22.tmp 39 PID 2824 wrote to memory of 2440 2824 CA22.tmp 39 PID 2824 wrote to memory of 2440 2824 CA22.tmp 39 PID 2440 wrote to memory of 2716 2440 CA8F.tmp 40 PID 2440 wrote to memory of 2716 2440 CA8F.tmp 40 PID 2440 wrote to memory of 2716 2440 CA8F.tmp 40 PID 2440 wrote to memory of 2716 2440 CA8F.tmp 40 PID 2716 wrote to memory of 2696 2716 CAED.tmp 41 PID 2716 wrote to memory of 2696 2716 CAED.tmp 41 PID 2716 wrote to memory of 2696 2716 CAED.tmp 41 PID 2716 wrote to memory of 2696 2716 CAED.tmp 41 PID 2696 wrote to memory of 1172 2696 CB6A.tmp 42 PID 2696 wrote to memory of 1172 2696 CB6A.tmp 42 PID 2696 wrote to memory of 1172 2696 CB6A.tmp 42 PID 2696 wrote to memory of 1172 2696 CB6A.tmp 42 PID 1172 wrote to memory of 2388 1172 CBD7.tmp 43 PID 1172 wrote to memory of 2388 1172 CBD7.tmp 43 PID 1172 wrote to memory of 2388 1172 CBD7.tmp 43 PID 1172 wrote to memory of 2388 1172 CBD7.tmp 43 PID 2388 wrote to memory of 2272 2388 CC44.tmp 44 PID 2388 wrote to memory of 2272 2388 CC44.tmp 44 PID 2388 wrote to memory of 2272 2388 CC44.tmp 44 PID 2388 wrote to memory of 2272 2388 CC44.tmp 44 PID 2272 wrote to memory of 1452 2272 CCC1.tmp 45 PID 2272 wrote to memory of 1452 2272 CCC1.tmp 45 PID 2272 wrote to memory of 1452 2272 CCC1.tmp 45 PID 2272 wrote to memory of 1452 2272 CCC1.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_8a1e70d3b70164431b7ff3a40cb22c26_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"C:\Users\Admin\AppData\Local\Temp\C7F1.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"C:\Users\Admin\AppData\Local\Temp\C8CB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\CA22.tmp"C:\Users\Admin\AppData\Local\Temp\CA22.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"C:\Users\Admin\AppData\Local\Temp\CBD7.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:436 -
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:276 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\D134.tmp"C:\Users\Admin\AppData\Local\Temp\D134.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\D172.tmp"C:\Users\Admin\AppData\Local\Temp\D172.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\D22E.tmp"C:\Users\Admin\AppData\Local\Temp\D22E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:864 -
C:\Users\Admin\AppData\Local\Temp\D26C.tmp"C:\Users\Admin\AppData\Local\Temp\D26C.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"C:\Users\Admin\AppData\Local\Temp\D2AA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"C:\Users\Admin\AppData\Local\Temp\D2E9.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\D327.tmp"C:\Users\Admin\AppData\Local\Temp\D327.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\D3B4.tmp"C:\Users\Admin\AppData\Local\Temp\D3B4.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\D53A.tmp"C:\Users\Admin\AppData\Local\Temp\D53A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\D578.tmp"C:\Users\Admin\AppData\Local\Temp\D578.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"C:\Users\Admin\AppData\Local\Temp\D5B6.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"C:\Users\Admin\AppData\Local\Temp\D5F5.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\D633.tmp"C:\Users\Admin\AppData\Local\Temp\D633.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\D672.tmp"C:\Users\Admin\AppData\Local\Temp\D672.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"C:\Users\Admin\AppData\Local\Temp\D6B0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"C:\Users\Admin\AppData\Local\Temp\D6EE.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\D72D.tmp"C:\Users\Admin\AppData\Local\Temp\D72D.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\D76B.tmp"C:\Users\Admin\AppData\Local\Temp\D76B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\D7AA.tmp"C:\Users\Admin\AppData\Local\Temp\D7AA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"C:\Users\Admin\AppData\Local\Temp\D7E8.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"C:\Users\Admin\AppData\Local\Temp\D8A3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"C:\Users\Admin\AppData\Local\Temp\D8E2.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"C:\Users\Admin\AppData\Local\Temp\D9EB.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\DA29.tmp"C:\Users\Admin\AppData\Local\Temp\DA29.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\DA68.tmp"C:\Users\Admin\AppData\Local\Temp\DA68.tmp"65⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"66⤵PID:1852
-
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"67⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"68⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\DB61.tmp"C:\Users\Admin\AppData\Local\Temp\DB61.tmp"69⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\DBA0.tmp"C:\Users\Admin\AppData\Local\Temp\DBA0.tmp"70⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"C:\Users\Admin\AppData\Local\Temp\DBDE.tmp"71⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"C:\Users\Admin\AppData\Local\Temp\DC1C.tmp"72⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"C:\Users\Admin\AppData\Local\Temp\DC5B.tmp"73⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\DC99.tmp"C:\Users\Admin\AppData\Local\Temp\DC99.tmp"74⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\DCD8.tmp"C:\Users\Admin\AppData\Local\Temp\DCD8.tmp"75⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\DD16.tmp"C:\Users\Admin\AppData\Local\Temp\DD16.tmp"76⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\DD54.tmp"C:\Users\Admin\AppData\Local\Temp\DD54.tmp"77⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\DD93.tmp"C:\Users\Admin\AppData\Local\Temp\DD93.tmp"78⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"C:\Users\Admin\AppData\Local\Temp\DDD1.tmp"79⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\DE10.tmp"C:\Users\Admin\AppData\Local\Temp\DE10.tmp"80⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"C:\Users\Admin\AppData\Local\Temp\DE4E.tmp"81⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"C:\Users\Admin\AppData\Local\Temp\DE8C.tmp"82⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\DECB.tmp"C:\Users\Admin\AppData\Local\Temp\DECB.tmp"83⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\DF09.tmp"C:\Users\Admin\AppData\Local\Temp\DF09.tmp"84⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\DF48.tmp"C:\Users\Admin\AppData\Local\Temp\DF48.tmp"85⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\DF86.tmp"C:\Users\Admin\AppData\Local\Temp\DF86.tmp"86⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"C:\Users\Admin\AppData\Local\Temp\DFD4.tmp"87⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\E012.tmp"C:\Users\Admin\AppData\Local\Temp\E012.tmp"88⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\E051.tmp"C:\Users\Admin\AppData\Local\Temp\E051.tmp"89⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\E08F.tmp"C:\Users\Admin\AppData\Local\Temp\E08F.tmp"90⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"C:\Users\Admin\AppData\Local\Temp\E0CE.tmp"91⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\E10C.tmp"C:\Users\Admin\AppData\Local\Temp\E10C.tmp"92⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\E14A.tmp"C:\Users\Admin\AppData\Local\Temp\E14A.tmp"93⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\E189.tmp"C:\Users\Admin\AppData\Local\Temp\E189.tmp"94⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"C:\Users\Admin\AppData\Local\Temp\E1C7.tmp"95⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\E244.tmp"C:\Users\Admin\AppData\Local\Temp\E244.tmp"97⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"98⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"99⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"100⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"101⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"102⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"103⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"104⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"105⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\E485.tmp"C:\Users\Admin\AppData\Local\Temp\E485.tmp"106⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"C:\Users\Admin\AppData\Local\Temp\E4C4.tmp"107⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\E502.tmp"C:\Users\Admin\AppData\Local\Temp\E502.tmp"108⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\E540.tmp"C:\Users\Admin\AppData\Local\Temp\E540.tmp"109⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\E57F.tmp"C:\Users\Admin\AppData\Local\Temp\E57F.tmp"110⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"C:\Users\Admin\AppData\Local\Temp\E5BD.tmp"111⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"112⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\E63A.tmp"C:\Users\Admin\AppData\Local\Temp\E63A.tmp"113⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\E678.tmp"C:\Users\Admin\AppData\Local\Temp\E678.tmp"114⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"C:\Users\Admin\AppData\Local\Temp\E6B7.tmp"115⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"C:\Users\Admin\AppData\Local\Temp\E6F5.tmp"116⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"117⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\E772.tmp"C:\Users\Admin\AppData\Local\Temp\E772.tmp"118⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"119⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"120⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\E82D.tmp"C:\Users\Admin\AppData\Local\Temp\E82D.tmp"121⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\E86C.tmp"C:\Users\Admin\AppData\Local\Temp\E86C.tmp"122⤵PID:2392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-