Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
02/09/2024, 06:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe
-
Size
536KB
-
MD5
8d98fa87e4c62df9db918c9db29eb297
-
SHA1
57c98dab17c4fe70b9351b9acaa4237a1c0c7eab
-
SHA256
a82d3aa07e8f6b3e1292c8a6ab21f3edc35a5e18946b7cd4a27b2fdb90a2752b
-
SHA512
e24bd24cea4db5cea5458f08e2670efd391c94f02852e0a0bb07dee2e56f7781340259641a311c2cbea6cb6879ac8b3dd460bd73ecc3da606b8c4ef55e795221
-
SSDEEP
12288:wU5rCOTeiU186xJ6OIX/JHjVN7YbE+o/vSfE7IZxVJ0ZT9:wUQOJU192XxHPYbEbIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1692 8FB2.tmp 2444 901F.tmp 2120 90BB.tmp 2764 9167.tmp 2912 91F3.tmp 2872 928F.tmp 2816 933B.tmp 2024 93A8.tmp 2652 9463.tmp 1956 951E.tmp 2664 95AB.tmp 316 9647.tmp 1336 96D3.tmp 3068 976F.tmp 2924 980B.tmp 1784 9878.tmp 540 9924.tmp 2088 99B0.tmp 2260 9A4C.tmp 1736 9B07.tmp 2456 9BA3.tmp 2364 9C11.tmp 444 9CAD.tmp 2632 9CFB.tmp 2964 9D68.tmp 1876 9DB6.tmp 1528 9E23.tmp 1524 9E61.tmp 1816 9EEE.tmp 772 9F5B.tmp 2224 9FB9.tmp 2240 A026.tmp 1556 A083.tmp 2520 A0F1.tmp 1988 A15E.tmp 1200 A1AC.tmp 1408 A209.tmp 1772 A257.tmp 2592 A2E4.tmp 2428 A351.tmp 2112 A39F.tmp 2388 A3ED.tmp 2840 A41C.tmp 2868 A45A.tmp 2916 A499.tmp 2860 A4D7.tmp 2588 A515.tmp 2336 A554.tmp 2820 A592.tmp 2848 A5D1.tmp 2660 A60F.tmp 2324 A64D.tmp 1956 A68C.tmp 2636 A6CA.tmp 2540 A709.tmp 1760 A747.tmp 1152 A785.tmp 3068 A7C4.tmp 2152 A802.tmp 2172 A841.tmp 1784 A87F.tmp 1776 A8BD.tmp 2248 A8EC.tmp 2300 A92B.tmp -
Loads dropped DLL 64 IoCs
pid Process 2572 2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe 1692 8FB2.tmp 2444 901F.tmp 2120 90BB.tmp 2764 9167.tmp 2912 91F3.tmp 2872 928F.tmp 2816 933B.tmp 2024 93A8.tmp 2652 9463.tmp 1956 951E.tmp 2664 95AB.tmp 316 9647.tmp 1336 96D3.tmp 3068 976F.tmp 2924 980B.tmp 1784 9878.tmp 540 9924.tmp 2088 99B0.tmp 2260 9A4C.tmp 1736 9B07.tmp 2456 9BA3.tmp 2364 9C11.tmp 444 9CAD.tmp 2632 9CFB.tmp 2964 9D68.tmp 1876 9DB6.tmp 1528 9E23.tmp 1524 9E61.tmp 1816 9EEE.tmp 772 9F5B.tmp 2224 9FB9.tmp 2240 A026.tmp 1556 A083.tmp 2520 A0F1.tmp 1988 A15E.tmp 1200 A1AC.tmp 1408 A209.tmp 1772 A257.tmp 2592 A2E4.tmp 2428 A351.tmp 2112 A39F.tmp 2388 A3ED.tmp 2840 A41C.tmp 2868 A45A.tmp 2916 A499.tmp 2860 A4D7.tmp 2588 A515.tmp 2336 A554.tmp 2820 A592.tmp 2848 A5D1.tmp 2660 A60F.tmp 2324 A64D.tmp 1956 A68C.tmp 2636 A6CA.tmp 2540 A709.tmp 1760 A747.tmp 1152 A785.tmp 3068 A7C4.tmp 2152 A802.tmp 2172 A841.tmp 1784 A87F.tmp 1776 A8BD.tmp 2248 A8EC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F90E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 787A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C439.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 149A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D10.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9157.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7D99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5310.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 698C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 950F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B819.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2572 wrote to memory of 1692 2572 2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe 30 PID 2572 wrote to memory of 1692 2572 2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe 30 PID 2572 wrote to memory of 1692 2572 2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe 30 PID 2572 wrote to memory of 1692 2572 2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe 30 PID 1692 wrote to memory of 2444 1692 8FB2.tmp 31 PID 1692 wrote to memory of 2444 1692 8FB2.tmp 31 PID 1692 wrote to memory of 2444 1692 8FB2.tmp 31 PID 1692 wrote to memory of 2444 1692 8FB2.tmp 31 PID 2444 wrote to memory of 2120 2444 901F.tmp 32 PID 2444 wrote to memory of 2120 2444 901F.tmp 32 PID 2444 wrote to memory of 2120 2444 901F.tmp 32 PID 2444 wrote to memory of 2120 2444 901F.tmp 32 PID 2120 wrote to memory of 2764 2120 90BB.tmp 33 PID 2120 wrote to memory of 2764 2120 90BB.tmp 33 PID 2120 wrote to memory of 2764 2120 90BB.tmp 33 PID 2120 wrote to memory of 2764 2120 90BB.tmp 33 PID 2764 wrote to memory of 2912 2764 9167.tmp 34 PID 2764 wrote to memory of 2912 2764 9167.tmp 34 PID 2764 wrote to memory of 2912 2764 9167.tmp 34 PID 2764 wrote to memory of 2912 2764 9167.tmp 34 PID 2912 wrote to memory of 2872 2912 91F3.tmp 35 PID 2912 wrote to memory of 2872 2912 91F3.tmp 35 PID 2912 wrote to memory of 2872 2912 91F3.tmp 35 PID 2912 wrote to memory of 2872 2912 91F3.tmp 35 PID 2872 wrote to memory of 2816 2872 928F.tmp 36 PID 2872 wrote to memory of 2816 2872 928F.tmp 36 PID 2872 wrote to memory of 2816 2872 928F.tmp 36 PID 2872 wrote to memory of 2816 2872 928F.tmp 36 PID 2816 wrote to memory of 2024 2816 933B.tmp 37 PID 2816 wrote to memory of 2024 2816 933B.tmp 37 PID 2816 wrote to memory of 2024 2816 933B.tmp 37 PID 2816 wrote to memory of 2024 2816 933B.tmp 37 PID 2024 wrote to memory of 2652 2024 93A8.tmp 38 PID 2024 wrote to memory of 2652 2024 93A8.tmp 38 PID 2024 wrote to memory of 2652 2024 93A8.tmp 38 PID 2024 wrote to memory of 2652 2024 93A8.tmp 38 PID 2652 wrote to memory of 1956 2652 9463.tmp 39 PID 2652 wrote to memory of 1956 2652 9463.tmp 39 PID 2652 wrote to memory of 1956 2652 9463.tmp 39 PID 2652 wrote to memory of 1956 2652 9463.tmp 39 PID 1956 wrote to memory of 2664 1956 951E.tmp 40 PID 1956 wrote to memory of 2664 1956 951E.tmp 40 PID 1956 wrote to memory of 2664 1956 951E.tmp 40 PID 1956 wrote to memory of 2664 1956 951E.tmp 40 PID 2664 wrote to memory of 316 2664 95AB.tmp 41 PID 2664 wrote to memory of 316 2664 95AB.tmp 41 PID 2664 wrote to memory of 316 2664 95AB.tmp 41 PID 2664 wrote to memory of 316 2664 95AB.tmp 41 PID 316 wrote to memory of 1336 316 9647.tmp 42 PID 316 wrote to memory of 1336 316 9647.tmp 42 PID 316 wrote to memory of 1336 316 9647.tmp 42 PID 316 wrote to memory of 1336 316 9647.tmp 42 PID 1336 wrote to memory of 3068 1336 96D3.tmp 43 PID 1336 wrote to memory of 3068 1336 96D3.tmp 43 PID 1336 wrote to memory of 3068 1336 96D3.tmp 43 PID 1336 wrote to memory of 3068 1336 96D3.tmp 43 PID 3068 wrote to memory of 2924 3068 976F.tmp 44 PID 3068 wrote to memory of 2924 3068 976F.tmp 44 PID 3068 wrote to memory of 2924 3068 976F.tmp 44 PID 3068 wrote to memory of 2924 3068 976F.tmp 44 PID 2924 wrote to memory of 1784 2924 980B.tmp 45 PID 2924 wrote to memory of 1784 2924 980B.tmp 45 PID 2924 wrote to memory of 1784 2924 980B.tmp 45 PID 2924 wrote to memory of 1784 2924 980B.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-02_8d98fa87e4c62df9db918c9db29eb297_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\901F.tmp"C:\Users\Admin\AppData\Local\Temp\901F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\90BB.tmp"C:\Users\Admin\AppData\Local\Temp\90BB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\9167.tmp"C:\Users\Admin\AppData\Local\Temp\9167.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\91F3.tmp"C:\Users\Admin\AppData\Local\Temp\91F3.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\933B.tmp"C:\Users\Admin\AppData\Local\Temp\933B.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\96D3.tmp"C:\Users\Admin\AppData\Local\Temp\96D3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\980B.tmp"C:\Users\Admin\AppData\Local\Temp\980B.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9E61.tmp"C:\Users\Admin\AppData\Local\Temp\9E61.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"C:\Users\Admin\AppData\Local\Temp\9EEE.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\A026.tmp"C:\Users\Admin\AppData\Local\Temp\A026.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\A083.tmp"C:\Users\Admin\AppData\Local\Temp\A083.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"C:\Users\Admin\AppData\Local\Temp\A1AC.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"C:\Users\Admin\AppData\Local\Temp\A2E4.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\A39F.tmp"C:\Users\Admin\AppData\Local\Temp\A39F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\A41C.tmp"C:\Users\Admin\AppData\Local\Temp\A41C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\A45A.tmp"C:\Users\Admin\AppData\Local\Temp\A45A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\A499.tmp"C:\Users\Admin\AppData\Local\Temp\A499.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"C:\Users\Admin\AppData\Local\Temp\A4D7.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\A554.tmp"C:\Users\Admin\AppData\Local\Temp\A554.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\A592.tmp"C:\Users\Admin\AppData\Local\Temp\A592.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"C:\Users\Admin\AppData\Local\Temp\A5D1.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\A60F.tmp"C:\Users\Admin\AppData\Local\Temp\A60F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\A68C.tmp"C:\Users\Admin\AppData\Local\Temp\A68C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"C:\Users\Admin\AppData\Local\Temp\A6CA.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\A785.tmp"C:\Users\Admin\AppData\Local\Temp\A785.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"C:\Users\Admin\AppData\Local\Temp\A7C4.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A802.tmp"C:\Users\Admin\AppData\Local\Temp\A802.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\A841.tmp"C:\Users\Admin\AppData\Local\Temp\A841.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"C:\Users\Admin\AppData\Local\Temp\A8BD.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"65⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A969.tmp"C:\Users\Admin\AppData\Local\Temp\A969.tmp"66⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"67⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"68⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"69⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"70⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"71⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"72⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"73⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"74⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"75⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"76⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"77⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"78⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"79⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"80⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"81⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"82⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"83⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"84⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"85⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"86⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"87⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"88⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"89⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"90⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"91⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"92⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"93⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"94⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\B07B.tmp"C:\Users\Admin\AppData\Local\Temp\B07B.tmp"95⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"96⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"97⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"98⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"99⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"100⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"101⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"102⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"103⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"104⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"105⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"106⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"107⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"108⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"109⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\B461.tmp"C:\Users\Admin\AppData\Local\Temp\B461.tmp"111⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B49F.tmp"C:\Users\Admin\AppData\Local\Temp\B49F.tmp"112⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"C:\Users\Admin\AppData\Local\Temp\B4DE.tmp"113⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B51C.tmp"C:\Users\Admin\AppData\Local\Temp\B51C.tmp"114⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\B55B.tmp"C:\Users\Admin\AppData\Local\Temp\B55B.tmp"115⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"116⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"C:\Users\Admin\AppData\Local\Temp\B5D7.tmp"117⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"118⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"119⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"120⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"121⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"122⤵PID:2168
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-