Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 08:24
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe
-
Size
529KB
-
MD5
7091e8885c2a7712200a092c16d2e15c
-
SHA1
73c1d8cc18888ee64fff3a1c1b1d60e6e9df1da2
-
SHA256
8ec46a0caaea4c863c380d555a34735c496f4beb64287765f0b125c2de20ab66
-
SHA512
da045c34b3fe6190c1c8aa177a007e1af315737fee73e2b37d653755a1bb362594ec7097cb75561212a808931c4c6145a8e8048301c8b9c5a39c72992e933227
-
SSDEEP
12288:NU5rCOTeijUYAFSLD8UbwiT1mIw8NOu1STZwlH4Hp:NUQOJjSFqF33NtQTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2508 8382.tmp 2920 83FF.tmp 2476 849B.tmp 2160 8508.tmp 2832 8575.tmp 2708 85F2.tmp 2764 865F.tmp 2896 86CC.tmp 2740 8739.tmp 2600 8797.tmp 2668 8804.tmp 3004 8871.tmp 1768 88DF.tmp 684 893C.tmp 2780 89B9.tmp 1924 8A26.tmp 2988 8A93.tmp 1684 8AF1.tmp 3016 8B6E.tmp 1996 8BCB.tmp 1324 8C48.tmp 2116 8CB5.tmp 2176 8D03.tmp 2124 8D42.tmp 532 8D80.tmp 2956 8DBF.tmp 572 8DFD.tmp 2564 8E3B.tmp 2284 8E7A.tmp 1976 8EB8.tmp 1640 8EF7.tmp 2320 8F35.tmp 544 8F73.tmp 1368 8FC1.tmp 1056 900F.tmp 784 904E.tmp 2940 908C.tmp 1280 90CB.tmp 1952 9109.tmp 2788 9147.tmp 920 9186.tmp 2012 91D4.tmp 2548 9222.tmp 2568 9260.tmp 2560 929F.tmp 1960 92DD.tmp 1776 931B.tmp 3064 9369.tmp 1500 93A8.tmp 1792 93E6.tmp 2520 9425.tmp 2032 9473.tmp 1708 94B1.tmp 2504 94EF.tmp 1348 952E.tmp 3012 956C.tmp 2920 95AB.tmp 2748 95E9.tmp 2820 9637.tmp 2864 9685.tmp 2832 9702.tmp 2928 976F.tmp 2708 97AD.tmp 2636 97EC.tmp -
Loads dropped DLL 64 IoCs
pid Process 2504 2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe 2508 8382.tmp 2920 83FF.tmp 2476 849B.tmp 2160 8508.tmp 2832 8575.tmp 2708 85F2.tmp 2764 865F.tmp 2896 86CC.tmp 2740 8739.tmp 2600 8797.tmp 2668 8804.tmp 3004 8871.tmp 1768 88DF.tmp 684 893C.tmp 2780 89B9.tmp 1924 8A26.tmp 2988 8A93.tmp 1684 8AF1.tmp 3016 8B6E.tmp 1996 8BCB.tmp 1324 8C48.tmp 2116 8CB5.tmp 2176 8D03.tmp 2124 8D42.tmp 532 8D80.tmp 2956 8DBF.tmp 572 8DFD.tmp 2564 8E3B.tmp 2284 8E7A.tmp 1976 8EB8.tmp 1640 8EF7.tmp 2320 8F35.tmp 544 8F73.tmp 1368 8FC1.tmp 1056 900F.tmp 784 904E.tmp 2940 908C.tmp 1280 90CB.tmp 1952 9109.tmp 2788 9147.tmp 920 9186.tmp 2012 91D4.tmp 2548 9222.tmp 2568 9260.tmp 2560 929F.tmp 1960 92DD.tmp 1776 931B.tmp 3064 9369.tmp 1500 93A8.tmp 1792 93E6.tmp 2520 9425.tmp 2032 9473.tmp 1708 94B1.tmp 2504 94EF.tmp 1348 952E.tmp 3012 956C.tmp 2920 95AB.tmp 2748 95E9.tmp 2820 9637.tmp 2864 9685.tmp 2832 9702.tmp 2928 976F.tmp 2708 97AD.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6152.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D4EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A52.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 194B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8739.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 47E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7945.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 891D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B857.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E65.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B26E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C477.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B970.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1BBB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7494.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2508 2504 2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe 30 PID 2504 wrote to memory of 2508 2504 2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe 30 PID 2504 wrote to memory of 2508 2504 2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe 30 PID 2504 wrote to memory of 2508 2504 2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe 30 PID 2508 wrote to memory of 2920 2508 8382.tmp 31 PID 2508 wrote to memory of 2920 2508 8382.tmp 31 PID 2508 wrote to memory of 2920 2508 8382.tmp 31 PID 2508 wrote to memory of 2920 2508 8382.tmp 31 PID 2920 wrote to memory of 2476 2920 83FF.tmp 32 PID 2920 wrote to memory of 2476 2920 83FF.tmp 32 PID 2920 wrote to memory of 2476 2920 83FF.tmp 32 PID 2920 wrote to memory of 2476 2920 83FF.tmp 32 PID 2476 wrote to memory of 2160 2476 849B.tmp 33 PID 2476 wrote to memory of 2160 2476 849B.tmp 33 PID 2476 wrote to memory of 2160 2476 849B.tmp 33 PID 2476 wrote to memory of 2160 2476 849B.tmp 33 PID 2160 wrote to memory of 2832 2160 8508.tmp 34 PID 2160 wrote to memory of 2832 2160 8508.tmp 34 PID 2160 wrote to memory of 2832 2160 8508.tmp 34 PID 2160 wrote to memory of 2832 2160 8508.tmp 34 PID 2832 wrote to memory of 2708 2832 8575.tmp 35 PID 2832 wrote to memory of 2708 2832 8575.tmp 35 PID 2832 wrote to memory of 2708 2832 8575.tmp 35 PID 2832 wrote to memory of 2708 2832 8575.tmp 35 PID 2708 wrote to memory of 2764 2708 85F2.tmp 36 PID 2708 wrote to memory of 2764 2708 85F2.tmp 36 PID 2708 wrote to memory of 2764 2708 85F2.tmp 36 PID 2708 wrote to memory of 2764 2708 85F2.tmp 36 PID 2764 wrote to memory of 2896 2764 865F.tmp 37 PID 2764 wrote to memory of 2896 2764 865F.tmp 37 PID 2764 wrote to memory of 2896 2764 865F.tmp 37 PID 2764 wrote to memory of 2896 2764 865F.tmp 37 PID 2896 wrote to memory of 2740 2896 86CC.tmp 38 PID 2896 wrote to memory of 2740 2896 86CC.tmp 38 PID 2896 wrote to memory of 2740 2896 86CC.tmp 38 PID 2896 wrote to memory of 2740 2896 86CC.tmp 38 PID 2740 wrote to memory of 2600 2740 8739.tmp 39 PID 2740 wrote to memory of 2600 2740 8739.tmp 39 PID 2740 wrote to memory of 2600 2740 8739.tmp 39 PID 2740 wrote to memory of 2600 2740 8739.tmp 39 PID 2600 wrote to memory of 2668 2600 8797.tmp 40 PID 2600 wrote to memory of 2668 2600 8797.tmp 40 PID 2600 wrote to memory of 2668 2600 8797.tmp 40 PID 2600 wrote to memory of 2668 2600 8797.tmp 40 PID 2668 wrote to memory of 3004 2668 8804.tmp 41 PID 2668 wrote to memory of 3004 2668 8804.tmp 41 PID 2668 wrote to memory of 3004 2668 8804.tmp 41 PID 2668 wrote to memory of 3004 2668 8804.tmp 41 PID 3004 wrote to memory of 1768 3004 8871.tmp 42 PID 3004 wrote to memory of 1768 3004 8871.tmp 42 PID 3004 wrote to memory of 1768 3004 8871.tmp 42 PID 3004 wrote to memory of 1768 3004 8871.tmp 42 PID 1768 wrote to memory of 684 1768 88DF.tmp 43 PID 1768 wrote to memory of 684 1768 88DF.tmp 43 PID 1768 wrote to memory of 684 1768 88DF.tmp 43 PID 1768 wrote to memory of 684 1768 88DF.tmp 43 PID 684 wrote to memory of 2780 684 893C.tmp 44 PID 684 wrote to memory of 2780 684 893C.tmp 44 PID 684 wrote to memory of 2780 684 893C.tmp 44 PID 684 wrote to memory of 2780 684 893C.tmp 44 PID 2780 wrote to memory of 1924 2780 89B9.tmp 45 PID 2780 wrote to memory of 1924 2780 89B9.tmp 45 PID 2780 wrote to memory of 1924 2780 89B9.tmp 45 PID 2780 wrote to memory of 1924 2780 89B9.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_7091e8885c2a7712200a092c16d2e15c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\8508.tmp"C:\Users\Admin\AppData\Local\Temp\8508.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\86CC.tmp"C:\Users\Admin\AppData\Local\Temp\86CC.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\8804.tmp"C:\Users\Admin\AppData\Local\Temp\8804.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\88DF.tmp"C:\Users\Admin\AppData\Local\Temp\88DF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\893C.tmp"C:\Users\Admin\AppData\Local\Temp\893C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\8A93.tmp"C:\Users\Admin\AppData\Local\Temp\8A93.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"C:\Users\Admin\AppData\Local\Temp\8AF1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"C:\Users\Admin\AppData\Local\Temp\8B6E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"C:\Users\Admin\AppData\Local\Temp\8BCB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"C:\Users\Admin\AppData\Local\Temp\8FC1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\904E.tmp"C:\Users\Admin\AppData\Local\Temp\904E.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:784 -
C:\Users\Admin\AppData\Local\Temp\908C.tmp"C:\Users\Admin\AppData\Local\Temp\908C.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:920 -
C:\Users\Admin\AppData\Local\Temp\91D4.tmp"C:\Users\Admin\AppData\Local\Temp\91D4.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9637.tmp"C:\Users\Admin\AppData\Local\Temp\9637.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\9685.tmp"C:\Users\Admin\AppData\Local\Temp\9685.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\9702.tmp"C:\Users\Admin\AppData\Local\Temp\9702.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"65⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\983A.tmp"C:\Users\Admin\AppData\Local\Temp\983A.tmp"66⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\9878.tmp"C:\Users\Admin\AppData\Local\Temp\9878.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\98C6.tmp"C:\Users\Admin\AppData\Local\Temp\98C6.tmp"68⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"69⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\9943.tmp"C:\Users\Admin\AppData\Local\Temp\9943.tmp"70⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"71⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\99EF.tmp"C:\Users\Admin\AppData\Local\Temp\99EF.tmp"72⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"73⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"74⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"75⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"77⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"78⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"79⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"80⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"81⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"82⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"83⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\9D29.tmp"C:\Users\Admin\AppData\Local\Temp\9D29.tmp"84⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\9D68.tmp"C:\Users\Admin\AppData\Local\Temp\9D68.tmp"85⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"86⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"87⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"88⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\9E81.tmp"C:\Users\Admin\AppData\Local\Temp\9E81.tmp"89⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"C:\Users\Admin\AppData\Local\Temp\9ECF.tmp"90⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"91⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"92⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\9F99.tmp"C:\Users\Admin\AppData\Local\Temp\9F99.tmp"93⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"94⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\A016.tmp"C:\Users\Admin\AppData\Local\Temp\A016.tmp"95⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"96⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"97⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"C:\Users\Admin\AppData\Local\Temp\A0E1.tmp"98⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\A13F.tmp"C:\Users\Admin\AppData\Local\Temp\A13F.tmp"99⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\A18D.tmp"C:\Users\Admin\AppData\Local\Temp\A18D.tmp"100⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"C:\Users\Admin\AppData\Local\Temp\A1CB.tmp"101⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\A209.tmp"C:\Users\Admin\AppData\Local\Temp\A209.tmp"102⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"103⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\A286.tmp"C:\Users\Admin\AppData\Local\Temp\A286.tmp"104⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"105⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\A303.tmp"C:\Users\Admin\AppData\Local\Temp\A303.tmp"106⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\A341.tmp"C:\Users\Admin\AppData\Local\Temp\A341.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\A380.tmp"C:\Users\Admin\AppData\Local\Temp\A380.tmp"108⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"C:\Users\Admin\AppData\Local\Temp\A3BE.tmp"109⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"C:\Users\Admin\AppData\Local\Temp\A3FD.tmp"110⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"111⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"112⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"113⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"C:\Users\Admin\AppData\Local\Temp\A4F6.tmp"114⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\A535.tmp"C:\Users\Admin\AppData\Local\Temp\A535.tmp"115⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\A573.tmp"C:\Users\Admin\AppData\Local\Temp\A573.tmp"116⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"117⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"118⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"119⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"120⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"121⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\A709.tmp"C:\Users\Admin\AppData\Local\Temp\A709.tmp"122⤵PID:2712
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-