Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 04:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe
-
Size
520KB
-
MD5
c36178dd6b9eb11af4775d8ba12c9181
-
SHA1
ee77ce8d0d1d28b696d11d616d36fa93712561ec
-
SHA256
4e6a4c6c9719e0b18e3826a7d8fe753dd60891c9db9c8f4de32de9989ee14306
-
SHA512
91df73341a0bb5f779a66f5b8eff9d840850d1206309c602027ebec6ffc9aa192f478b299ea18903ed7ef3a957efe66fe25d443edc943fe00a71df35ae5de812
-
SSDEEP
12288:gj8fuxR21t5i8fs7O3aB8rtRhlk/dS2rh3PFkNZ:gj8fuK1GYsC3rs0N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2056 43E3.tmp 2220 4422.tmp 2772 4470.tmp 2680 44DD.tmp 2808 4569.tmp 2560 45D6.tmp 2548 4644.tmp 2824 46B1.tmp 2568 471E.tmp 3064 479B.tmp 2540 4808.tmp 1168 4846.tmp 448 48B4.tmp 2408 4921.tmp 2504 498E.tmp 2208 49FB.tmp 2860 4A88.tmp 2712 4B04.tmp 2868 4B72.tmp 2836 4BEE.tmp 1680 4C5C.tmp 2084 4CC9.tmp 1492 4D36.tmp 2152 4D84.tmp 2016 4DC2.tmp 2052 4E01.tmp 2092 4E3F.tmp 2352 4E7E.tmp 2200 4EBC.tmp 808 4EFA.tmp 1936 4F39.tmp 2268 4F87.tmp 1320 4FE4.tmp 944 5023.tmp 2264 5071.tmp 1000 50AF.tmp 560 50EE.tmp 2256 512C.tmp 1816 516A.tmp 764 51A9.tmp 2012 51E7.tmp 2040 5235.tmp 2996 5274.tmp 2984 52B2.tmp 1264 52F0.tmp 776 532F.tmp 2024 536D.tmp 1084 53AC.tmp 2308 53EA.tmp 2280 5428.tmp 2108 5476.tmp 2928 54B5.tmp 2304 54F3.tmp 2616 5532.tmp 2184 5570.tmp 2788 55AE.tmp 2756 55ED.tmp 2652 562B.tmp 1968 566A.tmp 2368 56A8.tmp 2796 56F6.tmp 2804 5734.tmp 2872 5773.tmp 2700 57B1.tmp -
Loads dropped DLL 64 IoCs
pid Process 624 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe 2056 43E3.tmp 2220 4422.tmp 2772 4470.tmp 2680 44DD.tmp 2808 4569.tmp 2560 45D6.tmp 2548 4644.tmp 2824 46B1.tmp 2568 471E.tmp 3064 479B.tmp 2540 4808.tmp 1168 4846.tmp 448 48B4.tmp 2408 4921.tmp 2504 498E.tmp 2208 49FB.tmp 2860 4A88.tmp 2712 4B04.tmp 2868 4B72.tmp 2836 4BEE.tmp 1680 4C5C.tmp 2084 4CC9.tmp 1492 4D36.tmp 2152 4D84.tmp 2016 4DC2.tmp 2052 4E01.tmp 2092 4E3F.tmp 2352 4E7E.tmp 2200 4EBC.tmp 808 4EFA.tmp 1936 4F39.tmp 2268 4F87.tmp 1320 4FE4.tmp 944 5023.tmp 2264 5071.tmp 1000 50AF.tmp 560 50EE.tmp 2256 512C.tmp 1816 516A.tmp 764 51A9.tmp 2012 51E7.tmp 2040 5235.tmp 2996 5274.tmp 2984 52B2.tmp 1264 52F0.tmp 776 532F.tmp 2024 536D.tmp 1084 53AC.tmp 2308 53EA.tmp 2280 5428.tmp 2108 5476.tmp 2928 54B5.tmp 2304 54F3.tmp 2616 5532.tmp 2184 5570.tmp 2788 55AE.tmp 2756 55ED.tmp 2652 562B.tmp 1968 566A.tmp 2368 56A8.tmp 2796 56F6.tmp 2804 5734.tmp 2872 5773.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99A1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 144C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8DED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1297.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C83F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D23D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 566A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 758D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7169.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5D7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6133.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AD4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A332.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 624 wrote to memory of 2056 624 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe 30 PID 624 wrote to memory of 2056 624 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe 30 PID 624 wrote to memory of 2056 624 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe 30 PID 624 wrote to memory of 2056 624 2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe 30 PID 2056 wrote to memory of 2220 2056 43E3.tmp 31 PID 2056 wrote to memory of 2220 2056 43E3.tmp 31 PID 2056 wrote to memory of 2220 2056 43E3.tmp 31 PID 2056 wrote to memory of 2220 2056 43E3.tmp 31 PID 2220 wrote to memory of 2772 2220 4422.tmp 32 PID 2220 wrote to memory of 2772 2220 4422.tmp 32 PID 2220 wrote to memory of 2772 2220 4422.tmp 32 PID 2220 wrote to memory of 2772 2220 4422.tmp 32 PID 2772 wrote to memory of 2680 2772 4470.tmp 33 PID 2772 wrote to memory of 2680 2772 4470.tmp 33 PID 2772 wrote to memory of 2680 2772 4470.tmp 33 PID 2772 wrote to memory of 2680 2772 4470.tmp 33 PID 2680 wrote to memory of 2808 2680 44DD.tmp 34 PID 2680 wrote to memory of 2808 2680 44DD.tmp 34 PID 2680 wrote to memory of 2808 2680 44DD.tmp 34 PID 2680 wrote to memory of 2808 2680 44DD.tmp 34 PID 2808 wrote to memory of 2560 2808 4569.tmp 35 PID 2808 wrote to memory of 2560 2808 4569.tmp 35 PID 2808 wrote to memory of 2560 2808 4569.tmp 35 PID 2808 wrote to memory of 2560 2808 4569.tmp 35 PID 2560 wrote to memory of 2548 2560 45D6.tmp 36 PID 2560 wrote to memory of 2548 2560 45D6.tmp 36 PID 2560 wrote to memory of 2548 2560 45D6.tmp 36 PID 2560 wrote to memory of 2548 2560 45D6.tmp 36 PID 2548 wrote to memory of 2824 2548 4644.tmp 37 PID 2548 wrote to memory of 2824 2548 4644.tmp 37 PID 2548 wrote to memory of 2824 2548 4644.tmp 37 PID 2548 wrote to memory of 2824 2548 4644.tmp 37 PID 2824 wrote to memory of 2568 2824 46B1.tmp 38 PID 2824 wrote to memory of 2568 2824 46B1.tmp 38 PID 2824 wrote to memory of 2568 2824 46B1.tmp 38 PID 2824 wrote to memory of 2568 2824 46B1.tmp 38 PID 2568 wrote to memory of 3064 2568 471E.tmp 39 PID 2568 wrote to memory of 3064 2568 471E.tmp 39 PID 2568 wrote to memory of 3064 2568 471E.tmp 39 PID 2568 wrote to memory of 3064 2568 471E.tmp 39 PID 3064 wrote to memory of 2540 3064 479B.tmp 40 PID 3064 wrote to memory of 2540 3064 479B.tmp 40 PID 3064 wrote to memory of 2540 3064 479B.tmp 40 PID 3064 wrote to memory of 2540 3064 479B.tmp 40 PID 2540 wrote to memory of 1168 2540 4808.tmp 41 PID 2540 wrote to memory of 1168 2540 4808.tmp 41 PID 2540 wrote to memory of 1168 2540 4808.tmp 41 PID 2540 wrote to memory of 1168 2540 4808.tmp 41 PID 1168 wrote to memory of 448 1168 4846.tmp 42 PID 1168 wrote to memory of 448 1168 4846.tmp 42 PID 1168 wrote to memory of 448 1168 4846.tmp 42 PID 1168 wrote to memory of 448 1168 4846.tmp 42 PID 448 wrote to memory of 2408 448 48B4.tmp 43 PID 448 wrote to memory of 2408 448 48B4.tmp 43 PID 448 wrote to memory of 2408 448 48B4.tmp 43 PID 448 wrote to memory of 2408 448 48B4.tmp 43 PID 2408 wrote to memory of 2504 2408 4921.tmp 44 PID 2408 wrote to memory of 2504 2408 4921.tmp 44 PID 2408 wrote to memory of 2504 2408 4921.tmp 44 PID 2408 wrote to memory of 2504 2408 4921.tmp 44 PID 2504 wrote to memory of 2208 2504 498E.tmp 45 PID 2504 wrote to memory of 2208 2504 498E.tmp 45 PID 2504 wrote to memory of 2208 2504 498E.tmp 45 PID 2504 wrote to memory of 2208 2504 498E.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_c36178dd6b9eb11af4775d8ba12c9181_mafia.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\44DD.tmp"C:\Users\Admin\AppData\Local\Temp\44DD.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\45D6.tmp"C:\Users\Admin\AppData\Local\Temp\45D6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4644.tmp"C:\Users\Admin\AppData\Local\Temp\4644.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\46B1.tmp"C:\Users\Admin\AppData\Local\Temp\46B1.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4846.tmp"C:\Users\Admin\AppData\Local\Temp\4846.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4921.tmp"C:\Users\Admin\AppData\Local\Temp\4921.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\498E.tmp"C:\Users\Admin\AppData\Local\Temp\498E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\4B04.tmp"C:\Users\Admin\AppData\Local\Temp\4B04.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"C:\Users\Admin\AppData\Local\Temp\4C5C.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"C:\Users\Admin\AppData\Local\Temp\4CC9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"C:\Users\Admin\AppData\Local\Temp\4EFA.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:808 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:944 -
C:\Users\Admin\AppData\Local\Temp\5071.tmp"C:\Users\Admin\AppData\Local\Temp\5071.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\50AF.tmp"C:\Users\Admin\AppData\Local\Temp\50AF.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\50EE.tmp"C:\Users\Admin\AppData\Local\Temp\50EE.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\512C.tmp"C:\Users\Admin\AppData\Local\Temp\512C.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\51A9.tmp"C:\Users\Admin\AppData\Local\Temp\51A9.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\51E7.tmp"C:\Users\Admin\AppData\Local\Temp\51E7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\5235.tmp"C:\Users\Admin\AppData\Local\Temp\5235.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\5274.tmp"C:\Users\Admin\AppData\Local\Temp\5274.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\52B2.tmp"C:\Users\Admin\AppData\Local\Temp\52B2.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\52F0.tmp"C:\Users\Admin\AppData\Local\Temp\52F0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\532F.tmp"C:\Users\Admin\AppData\Local\Temp\532F.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\536D.tmp"C:\Users\Admin\AppData\Local\Temp\536D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\53AC.tmp"C:\Users\Admin\AppData\Local\Temp\53AC.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5428.tmp"C:\Users\Admin\AppData\Local\Temp\5428.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\5476.tmp"C:\Users\Admin\AppData\Local\Temp\5476.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\54B5.tmp"C:\Users\Admin\AppData\Local\Temp\54B5.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\54F3.tmp"C:\Users\Admin\AppData\Local\Temp\54F3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5532.tmp"C:\Users\Admin\AppData\Local\Temp\5532.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\56A8.tmp"C:\Users\Admin\AppData\Local\Temp\56A8.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5773.tmp"C:\Users\Admin\AppData\Local\Temp\5773.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\57B1.tmp"C:\Users\Admin\AppData\Local\Temp\57B1.tmp"65⤵
- Executes dropped EXE
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\57F0.tmp"C:\Users\Admin\AppData\Local\Temp\57F0.tmp"66⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\582E.tmp"C:\Users\Admin\AppData\Local\Temp\582E.tmp"67⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\586D.tmp"C:\Users\Admin\AppData\Local\Temp\586D.tmp"68⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\58AB.tmp"C:\Users\Admin\AppData\Local\Temp\58AB.tmp"69⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\58E9.tmp"C:\Users\Admin\AppData\Local\Temp\58E9.tmp"70⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\5928.tmp"C:\Users\Admin\AppData\Local\Temp\5928.tmp"71⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"72⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\59A5.tmp"C:\Users\Admin\AppData\Local\Temp\59A5.tmp"73⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"74⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\5A21.tmp"C:\Users\Admin\AppData\Local\Temp\5A21.tmp"75⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\5A60.tmp"C:\Users\Admin\AppData\Local\Temp\5A60.tmp"76⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"77⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"78⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"C:\Users\Admin\AppData\Local\Temp\5B1B.tmp"79⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"80⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5B98.tmp"C:\Users\Admin\AppData\Local\Temp\5B98.tmp"81⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"C:\Users\Admin\AppData\Local\Temp\5BD6.tmp"82⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\5C15.tmp"C:\Users\Admin\AppData\Local\Temp\5C15.tmp"83⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5C53.tmp"C:\Users\Admin\AppData\Local\Temp\5C53.tmp"84⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"85⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"86⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"87⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"C:\Users\Admin\AppData\Local\Temp\5D4D.tmp"88⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"C:\Users\Admin\AppData\Local\Temp\5D8B.tmp"89⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"C:\Users\Admin\AppData\Local\Temp\5DC9.tmp"90⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\5E08.tmp"C:\Users\Admin\AppData\Local\Temp\5E08.tmp"91⤵
- System Location Discovery: System Language Discovery
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\5E46.tmp"C:\Users\Admin\AppData\Local\Temp\5E46.tmp"92⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\5E85.tmp"C:\Users\Admin\AppData\Local\Temp\5E85.tmp"93⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"94⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5F01.tmp"C:\Users\Admin\AppData\Local\Temp\5F01.tmp"95⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"96⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"C:\Users\Admin\AppData\Local\Temp\5F7E.tmp"97⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"C:\Users\Admin\AppData\Local\Temp\5FBD.tmp"98⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"C:\Users\Admin\AppData\Local\Temp\5FFB.tmp"99⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"100⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"101⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"102⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\60F5.tmp"C:\Users\Admin\AppData\Local\Temp\60F5.tmp"103⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\6171.tmp"C:\Users\Admin\AppData\Local\Temp\6171.tmp"105⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\61B0.tmp"C:\Users\Admin\AppData\Local\Temp\61B0.tmp"106⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\61EE.tmp"C:\Users\Admin\AppData\Local\Temp\61EE.tmp"107⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\626B.tmp"C:\Users\Admin\AppData\Local\Temp\626B.tmp"109⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\62A9.tmp"C:\Users\Admin\AppData\Local\Temp\62A9.tmp"110⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\62E8.tmp"C:\Users\Admin\AppData\Local\Temp\62E8.tmp"111⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\6326.tmp"C:\Users\Admin\AppData\Local\Temp\6326.tmp"112⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\6365.tmp"C:\Users\Admin\AppData\Local\Temp\6365.tmp"113⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\63A3.tmp"C:\Users\Admin\AppData\Local\Temp\63A3.tmp"114⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"115⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6420.tmp"C:\Users\Admin\AppData\Local\Temp\6420.tmp"116⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"117⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\649D.tmp"C:\Users\Admin\AppData\Local\Temp\649D.tmp"118⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\64DB.tmp"C:\Users\Admin\AppData\Local\Temp\64DB.tmp"119⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"120⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"121⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"122⤵PID:2964
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-