Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 06:13
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe
-
Size
712KB
-
MD5
81a6c3286033fcc0c27ae411e5352f4c
-
SHA1
76a8a97f08c8a406d15e20f0a8ac026c0f0c8024
-
SHA256
0527d2574dc291821b463382b5c9e68e677cfee9f40eb0202d0c4b21e75017b4
-
SHA512
81e06c696c954d5d3c7bcaadf727bcdb59eb4416f854eb4965586035a5a2b6ab55c684a91105d5493e1180405fef9d58773e7f331127eb829676299e558b6237
-
SSDEEP
12288:FU5rCOTeiDe8vV+EpYDFU+6XBa930dNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzC:FUQOJDTHYDFU+6XUONnCvq5TJLCvY90E
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2532 1BAB.tmp 2772 1C38.tmp 3060 1C86.tmp 3044 1D41.tmp 2804 1D9E.tmp 2988 1DDD.tmp 2636 1E79.tmp 2592 1F05.tmp 2752 1F63.tmp 2360 1FE0.tmp 2568 206C.tmp 2324 20F8.tmp 2080 2166.tmp 1240 21E2.tmp 1260 2250.tmp 540 22DC.tmp 2840 2349.tmp 996 23C6.tmp 1020 2433.tmp 2676 24C0.tmp 2916 251D.tmp 2140 25AA.tmp 1532 2617.tmp 2200 2655.tmp 2452 26A3.tmp 2420 26E2.tmp 2320 2720.tmp 344 275E.tmp 1784 279D.tmp 2356 27EB.tmp 1860 2829.tmp 1276 2868.tmp 2464 28A6.tmp 856 28E4.tmp 288 2923.tmp 1624 2961.tmp 828 29A0.tmp 1436 29DE.tmp 1188 2A1C.tmp 1856 2A5B.tmp 1612 2A99.tmp 2312 2AD8.tmp 1204 2B16.tmp 2180 2B54.tmp 2224 2B93.tmp 380 2BD1.tmp 976 2C10.tmp 1720 2C4E.tmp 1988 2C8C.tmp 880 2CCB.tmp 2160 2D09.tmp 2068 2D48.tmp 1596 2D86.tmp 2176 2DD4.tmp 2732 2E12.tmp 2740 2E51.tmp 2772 2E8F.tmp 2392 2EDD.tmp 1364 2F1C.tmp 1540 2F5A.tmp 2604 2F98.tmp 2764 2FE6.tmp 2988 3025.tmp 2576 3063.tmp -
Loads dropped DLL 64 IoCs
pid Process 2120 2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe 2532 1BAB.tmp 2772 1C38.tmp 3060 1C86.tmp 3044 1D41.tmp 2804 1D9E.tmp 2988 1DDD.tmp 2636 1E79.tmp 2592 1F05.tmp 2752 1F63.tmp 2360 1FE0.tmp 2568 206C.tmp 2324 20F8.tmp 2080 2166.tmp 1240 21E2.tmp 1260 2250.tmp 540 22DC.tmp 2840 2349.tmp 996 23C6.tmp 1020 2433.tmp 2676 24C0.tmp 2916 251D.tmp 2140 25AA.tmp 1532 2617.tmp 2200 2655.tmp 2452 26A3.tmp 2420 26E2.tmp 2320 2720.tmp 344 275E.tmp 1784 279D.tmp 2356 27EB.tmp 1860 2829.tmp 1276 2868.tmp 2464 28A6.tmp 856 28E4.tmp 288 2923.tmp 1624 2961.tmp 828 29A0.tmp 1436 29DE.tmp 1188 2A1C.tmp 1856 2A5B.tmp 1612 2A99.tmp 2312 2AD8.tmp 1204 2B16.tmp 2180 2B54.tmp 2224 2B93.tmp 380 2BD1.tmp 976 2C10.tmp 1720 2C4E.tmp 1988 2C8C.tmp 880 2CCB.tmp 2160 2D09.tmp 2068 2D48.tmp 1596 2D86.tmp 2176 2DD4.tmp 2732 2E12.tmp 2740 2E51.tmp 2772 2E8F.tmp 2392 2EDD.tmp 1364 2F1C.tmp 1540 2F5A.tmp 2604 2F98.tmp 2764 2FE6.tmp 2988 3025.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7733.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ED4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CCC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F670.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3736.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F5F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4846.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF04.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EBA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A3F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8843.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2120 wrote to memory of 2532 2120 2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe 30 PID 2120 wrote to memory of 2532 2120 2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe 30 PID 2120 wrote to memory of 2532 2120 2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe 30 PID 2120 wrote to memory of 2532 2120 2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe 30 PID 2532 wrote to memory of 2772 2532 1BAB.tmp 31 PID 2532 wrote to memory of 2772 2532 1BAB.tmp 31 PID 2532 wrote to memory of 2772 2532 1BAB.tmp 31 PID 2532 wrote to memory of 2772 2532 1BAB.tmp 31 PID 2772 wrote to memory of 3060 2772 1C38.tmp 32 PID 2772 wrote to memory of 3060 2772 1C38.tmp 32 PID 2772 wrote to memory of 3060 2772 1C38.tmp 32 PID 2772 wrote to memory of 3060 2772 1C38.tmp 32 PID 3060 wrote to memory of 3044 3060 1C86.tmp 33 PID 3060 wrote to memory of 3044 3060 1C86.tmp 33 PID 3060 wrote to memory of 3044 3060 1C86.tmp 33 PID 3060 wrote to memory of 3044 3060 1C86.tmp 33 PID 3044 wrote to memory of 2804 3044 1D41.tmp 34 PID 3044 wrote to memory of 2804 3044 1D41.tmp 34 PID 3044 wrote to memory of 2804 3044 1D41.tmp 34 PID 3044 wrote to memory of 2804 3044 1D41.tmp 34 PID 2804 wrote to memory of 2988 2804 1D9E.tmp 35 PID 2804 wrote to memory of 2988 2804 1D9E.tmp 35 PID 2804 wrote to memory of 2988 2804 1D9E.tmp 35 PID 2804 wrote to memory of 2988 2804 1D9E.tmp 35 PID 2988 wrote to memory of 2636 2988 1DDD.tmp 36 PID 2988 wrote to memory of 2636 2988 1DDD.tmp 36 PID 2988 wrote to memory of 2636 2988 1DDD.tmp 36 PID 2988 wrote to memory of 2636 2988 1DDD.tmp 36 PID 2636 wrote to memory of 2592 2636 1E79.tmp 37 PID 2636 wrote to memory of 2592 2636 1E79.tmp 37 PID 2636 wrote to memory of 2592 2636 1E79.tmp 37 PID 2636 wrote to memory of 2592 2636 1E79.tmp 37 PID 2592 wrote to memory of 2752 2592 1F05.tmp 38 PID 2592 wrote to memory of 2752 2592 1F05.tmp 38 PID 2592 wrote to memory of 2752 2592 1F05.tmp 38 PID 2592 wrote to memory of 2752 2592 1F05.tmp 38 PID 2752 wrote to memory of 2360 2752 1F63.tmp 39 PID 2752 wrote to memory of 2360 2752 1F63.tmp 39 PID 2752 wrote to memory of 2360 2752 1F63.tmp 39 PID 2752 wrote to memory of 2360 2752 1F63.tmp 39 PID 2360 wrote to memory of 2568 2360 1FE0.tmp 40 PID 2360 wrote to memory of 2568 2360 1FE0.tmp 40 PID 2360 wrote to memory of 2568 2360 1FE0.tmp 40 PID 2360 wrote to memory of 2568 2360 1FE0.tmp 40 PID 2568 wrote to memory of 2324 2568 206C.tmp 41 PID 2568 wrote to memory of 2324 2568 206C.tmp 41 PID 2568 wrote to memory of 2324 2568 206C.tmp 41 PID 2568 wrote to memory of 2324 2568 206C.tmp 41 PID 2324 wrote to memory of 2080 2324 20F8.tmp 42 PID 2324 wrote to memory of 2080 2324 20F8.tmp 42 PID 2324 wrote to memory of 2080 2324 20F8.tmp 42 PID 2324 wrote to memory of 2080 2324 20F8.tmp 42 PID 2080 wrote to memory of 1240 2080 2166.tmp 43 PID 2080 wrote to memory of 1240 2080 2166.tmp 43 PID 2080 wrote to memory of 1240 2080 2166.tmp 43 PID 2080 wrote to memory of 1240 2080 2166.tmp 43 PID 1240 wrote to memory of 1260 1240 21E2.tmp 44 PID 1240 wrote to memory of 1260 1240 21E2.tmp 44 PID 1240 wrote to memory of 1260 1240 21E2.tmp 44 PID 1240 wrote to memory of 1260 1240 21E2.tmp 44 PID 1260 wrote to memory of 540 1260 2250.tmp 45 PID 1260 wrote to memory of 540 1260 2250.tmp 45 PID 1260 wrote to memory of 540 1260 2250.tmp 45 PID 1260 wrote to memory of 540 1260 2250.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-03_81a6c3286033fcc0c27ae411e5352f4c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"C:\Users\Admin\AppData\Local\Temp\1BAB.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\1C38.tmp"C:\Users\Admin\AppData\Local\Temp\1C38.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\1C86.tmp"C:\Users\Admin\AppData\Local\Temp\1C86.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\1D41.tmp"C:\Users\Admin\AppData\Local\Temp\1D41.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\1F63.tmp"C:\Users\Admin\AppData\Local\Temp\1F63.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"C:\Users\Admin\AppData\Local\Temp\1FE0.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\206C.tmp"C:\Users\Admin\AppData\Local\Temp\206C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\2250.tmp"C:\Users\Admin\AppData\Local\Temp\2250.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\22DC.tmp"C:\Users\Admin\AppData\Local\Temp\22DC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:540 -
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\251D.tmp"C:\Users\Admin\AppData\Local\Temp\251D.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\25AA.tmp"C:\Users\Admin\AppData\Local\Temp\25AA.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\2617.tmp"C:\Users\Admin\AppData\Local\Temp\2617.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\26E2.tmp"C:\Users\Admin\AppData\Local\Temp\26E2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\275E.tmp"C:\Users\Admin\AppData\Local\Temp\275E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:344 -
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\28A6.tmp"C:\Users\Admin\AppData\Local\Temp\28A6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:288 -
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"C:\Users\Admin\AppData\Local\Temp\2A1C.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:976 -
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"C:\Users\Admin\AppData\Local\Temp\2CCB.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\3063.tmp"C:\Users\Admin\AppData\Local\Temp\3063.tmp"65⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"67⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"68⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"69⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"70⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"71⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"72⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"73⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\32A4.tmp"C:\Users\Admin\AppData\Local\Temp\32A4.tmp"74⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\32E3.tmp"C:\Users\Admin\AppData\Local\Temp\32E3.tmp"75⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"76⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"77⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"78⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\33DC.tmp"C:\Users\Admin\AppData\Local\Temp\33DC.tmp"79⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"80⤵PID:2680
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"81⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\34A7.tmp"C:\Users\Admin\AppData\Local\Temp\34A7.tmp"82⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"83⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"84⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"85⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\35C0.tmp"C:\Users\Admin\AppData\Local\Temp\35C0.tmp"86⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"87⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\363D.tmp"C:\Users\Admin\AppData\Local\Temp\363D.tmp"88⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\367B.tmp"C:\Users\Admin\AppData\Local\Temp\367B.tmp"89⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\36BA.tmp"C:\Users\Admin\AppData\Local\Temp\36BA.tmp"90⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"91⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\3736.tmp"C:\Users\Admin\AppData\Local\Temp\3736.tmp"92⤵
- System Location Discovery: System Language Discovery
PID:848 -
C:\Users\Admin\AppData\Local\Temp\3775.tmp"C:\Users\Admin\AppData\Local\Temp\3775.tmp"93⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\37B3.tmp"C:\Users\Admin\AppData\Local\Temp\37B3.tmp"94⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\37F2.tmp"C:\Users\Admin\AppData\Local\Temp\37F2.tmp"95⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3830.tmp"C:\Users\Admin\AppData\Local\Temp\3830.tmp"96⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\386E.tmp"C:\Users\Admin\AppData\Local\Temp\386E.tmp"97⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\38AD.tmp"C:\Users\Admin\AppData\Local\Temp\38AD.tmp"98⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"99⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"100⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"101⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\39A6.tmp"C:\Users\Admin\AppData\Local\Temp\39A6.tmp"102⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\39E5.tmp"C:\Users\Admin\AppData\Local\Temp\39E5.tmp"103⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"104⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"105⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"C:\Users\Admin\AppData\Local\Temp\3AA0.tmp"106⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"C:\Users\Admin\AppData\Local\Temp\3ADE.tmp"107⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"108⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"C:\Users\Admin\AppData\Local\Temp\3B5B.tmp"109⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"C:\Users\Admin\AppData\Local\Temp\3B9A.tmp"110⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"C:\Users\Admin\AppData\Local\Temp\3BE8.tmp"111⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\3C26.tmp"C:\Users\Admin\AppData\Local\Temp\3C26.tmp"112⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"113⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"C:\Users\Admin\AppData\Local\Temp\3CA3.tmp"114⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"115⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\3D20.tmp"C:\Users\Admin\AppData\Local\Temp\3D20.tmp"116⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"C:\Users\Admin\AppData\Local\Temp\3D5E.tmp"117⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"C:\Users\Admin\AppData\Local\Temp\3D9C.tmp"118⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"C:\Users\Admin\AppData\Local\Temp\3DDB.tmp"119⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\3E19.tmp"C:\Users\Admin\AppData\Local\Temp\3E19.tmp"120⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3E58.tmp"C:\Users\Admin\AppData\Local\Temp\3E58.tmp"121⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\3E96.tmp"C:\Users\Admin\AppData\Local\Temp\3E96.tmp"122⤵PID:2776
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-