Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 08:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe
-
Size
541KB
-
MD5
0cb0a09aff068606ec014d5a430d3eb5
-
SHA1
913391cbaf043090ac49457f5c17a461ef25acec
-
SHA256
7611d0ae603efad2e6b1f74b2b53a454db92dc5a20d7441b691aaf4aa1ec005c
-
SHA512
ea775533a8e9ddf519180f7919ddc020c937310619599b57bf565a6ff1ac52665da595a3cd56ca6fe51758fdbb34ca2a5c7cc31984ed44f03bfb03e73976e30b
-
SSDEEP
12288:UU5rCOTeifMmD0alGeOzreSCp9i/ulJhKRrZa73ctO:UUQOJfMmD0alzou2wJirU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2276 77FD.tmp 2292 787A.tmp 2776 78F7.tmp 2084 7974.tmp 2636 7A00.tmp 2748 7A6D.tmp 2716 7AEA.tmp 2604 7B57.tmp 2516 7BD4.tmp 1980 7C41.tmp 2504 7CBE.tmp 2948 7D3B.tmp 2952 7DA8.tmp 1892 7E15.tmp 2788 7E92.tmp 2816 7F0F.tmp 2964 7F8C.tmp 2272 8018.tmp 1400 8095.tmp 2328 8112.tmp 1444 818F.tmp 2020 820B.tmp 2548 8259.tmp 1608 82A7.tmp 1936 82F5.tmp 1952 8334.tmp 1908 8382.tmp 536 83D0.tmp 2360 841E.tmp 2932 846C.tmp 772 84AA.tmp 2884 84E9.tmp 332 8537.tmp 2180 8575.tmp 1528 85B3.tmp 1556 85F2.tmp 2128 8640.tmp 1188 867E.tmp 1404 86BD.tmp 1704 86FB.tmp 1540 8739.tmp 1724 8778.tmp 828 87B6.tmp 1628 87F5.tmp 840 8833.tmp 2204 8871.tmp 3040 88B0.tmp 2140 890D.tmp 1968 896B.tmp 2060 89A9.tmp 2056 89F7.tmp 1752 8A36.tmp 3000 8A74.tmp 2148 8AB3.tmp 1868 8B01.tmp 1688 8B5E.tmp 2296 8BAC.tmp 2436 8BEB.tmp 1624 8C29.tmp 2968 8C67.tmp 2596 8CB5.tmp 2628 8CF4.tmp 2700 8D32.tmp 2644 8D71.tmp -
Loads dropped DLL 64 IoCs
pid Process 1868 2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe 2276 77FD.tmp 2292 787A.tmp 2776 78F7.tmp 2084 7974.tmp 2636 7A00.tmp 2748 7A6D.tmp 2716 7AEA.tmp 2604 7B57.tmp 2516 7BD4.tmp 1980 7C41.tmp 2504 7CBE.tmp 2948 7D3B.tmp 2952 7DA8.tmp 1892 7E15.tmp 2788 7E92.tmp 2816 7F0F.tmp 2964 7F8C.tmp 2272 8018.tmp 1400 8095.tmp 2328 8112.tmp 1444 818F.tmp 2020 820B.tmp 2548 8259.tmp 1608 82A7.tmp 1936 82F5.tmp 1952 8334.tmp 1908 8382.tmp 536 83D0.tmp 2360 841E.tmp 2932 846C.tmp 772 84AA.tmp 2884 84E9.tmp 332 8537.tmp 2180 8575.tmp 1528 85B3.tmp 1556 85F2.tmp 2128 8640.tmp 1188 867E.tmp 1404 86BD.tmp 1704 86FB.tmp 1540 8739.tmp 1724 8778.tmp 828 87B6.tmp 1628 87F5.tmp 840 8833.tmp 2204 8871.tmp 3040 88B0.tmp 2140 890D.tmp 1968 896B.tmp 2060 89A9.tmp 2056 89F7.tmp 1752 8A36.tmp 3000 8A74.tmp 2148 8AB3.tmp 1868 8B01.tmp 1688 8B5E.tmp 2296 8BAC.tmp 2436 8BEB.tmp 1624 8C29.tmp 2968 8C67.tmp 2596 8CB5.tmp 2628 8CF4.tmp 2700 8D32.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 650A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 69EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA96.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 903E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B50D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C043.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D069.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 927F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A248.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7AFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9666.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E456.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 53E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2276 1868 2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe 28 PID 1868 wrote to memory of 2276 1868 2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe 28 PID 1868 wrote to memory of 2276 1868 2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe 28 PID 1868 wrote to memory of 2276 1868 2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe 28 PID 2276 wrote to memory of 2292 2276 77FD.tmp 29 PID 2276 wrote to memory of 2292 2276 77FD.tmp 29 PID 2276 wrote to memory of 2292 2276 77FD.tmp 29 PID 2276 wrote to memory of 2292 2276 77FD.tmp 29 PID 2292 wrote to memory of 2776 2292 787A.tmp 30 PID 2292 wrote to memory of 2776 2292 787A.tmp 30 PID 2292 wrote to memory of 2776 2292 787A.tmp 30 PID 2292 wrote to memory of 2776 2292 787A.tmp 30 PID 2776 wrote to memory of 2084 2776 78F7.tmp 31 PID 2776 wrote to memory of 2084 2776 78F7.tmp 31 PID 2776 wrote to memory of 2084 2776 78F7.tmp 31 PID 2776 wrote to memory of 2084 2776 78F7.tmp 31 PID 2084 wrote to memory of 2636 2084 7974.tmp 32 PID 2084 wrote to memory of 2636 2084 7974.tmp 32 PID 2084 wrote to memory of 2636 2084 7974.tmp 32 PID 2084 wrote to memory of 2636 2084 7974.tmp 32 PID 2636 wrote to memory of 2748 2636 7A00.tmp 33 PID 2636 wrote to memory of 2748 2636 7A00.tmp 33 PID 2636 wrote to memory of 2748 2636 7A00.tmp 33 PID 2636 wrote to memory of 2748 2636 7A00.tmp 33 PID 2748 wrote to memory of 2716 2748 7A6D.tmp 34 PID 2748 wrote to memory of 2716 2748 7A6D.tmp 34 PID 2748 wrote to memory of 2716 2748 7A6D.tmp 34 PID 2748 wrote to memory of 2716 2748 7A6D.tmp 34 PID 2716 wrote to memory of 2604 2716 7AEA.tmp 35 PID 2716 wrote to memory of 2604 2716 7AEA.tmp 35 PID 2716 wrote to memory of 2604 2716 7AEA.tmp 35 PID 2716 wrote to memory of 2604 2716 7AEA.tmp 35 PID 2604 wrote to memory of 2516 2604 7B57.tmp 36 PID 2604 wrote to memory of 2516 2604 7B57.tmp 36 PID 2604 wrote to memory of 2516 2604 7B57.tmp 36 PID 2604 wrote to memory of 2516 2604 7B57.tmp 36 PID 2516 wrote to memory of 1980 2516 7BD4.tmp 37 PID 2516 wrote to memory of 1980 2516 7BD4.tmp 37 PID 2516 wrote to memory of 1980 2516 7BD4.tmp 37 PID 2516 wrote to memory of 1980 2516 7BD4.tmp 37 PID 1980 wrote to memory of 2504 1980 7C41.tmp 38 PID 1980 wrote to memory of 2504 1980 7C41.tmp 38 PID 1980 wrote to memory of 2504 1980 7C41.tmp 38 PID 1980 wrote to memory of 2504 1980 7C41.tmp 38 PID 2504 wrote to memory of 2948 2504 7CBE.tmp 39 PID 2504 wrote to memory of 2948 2504 7CBE.tmp 39 PID 2504 wrote to memory of 2948 2504 7CBE.tmp 39 PID 2504 wrote to memory of 2948 2504 7CBE.tmp 39 PID 2948 wrote to memory of 2952 2948 7D3B.tmp 40 PID 2948 wrote to memory of 2952 2948 7D3B.tmp 40 PID 2948 wrote to memory of 2952 2948 7D3B.tmp 40 PID 2948 wrote to memory of 2952 2948 7D3B.tmp 40 PID 2952 wrote to memory of 1892 2952 7DA8.tmp 41 PID 2952 wrote to memory of 1892 2952 7DA8.tmp 41 PID 2952 wrote to memory of 1892 2952 7DA8.tmp 41 PID 2952 wrote to memory of 1892 2952 7DA8.tmp 41 PID 1892 wrote to memory of 2788 1892 7E15.tmp 42 PID 1892 wrote to memory of 2788 1892 7E15.tmp 42 PID 1892 wrote to memory of 2788 1892 7E15.tmp 42 PID 1892 wrote to memory of 2788 1892 7E15.tmp 42 PID 2788 wrote to memory of 2816 2788 7E92.tmp 43 PID 2788 wrote to memory of 2816 2788 7E92.tmp 43 PID 2788 wrote to memory of 2816 2788 7E92.tmp 43 PID 2788 wrote to memory of 2816 2788 7E92.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-06_0cb0a09aff068606ec014d5a430d3eb5_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\77FD.tmp"C:\Users\Admin\AppData\Local\Temp\77FD.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\787A.tmp"C:\Users\Admin\AppData\Local\Temp\787A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\78F7.tmp"C:\Users\Admin\AppData\Local\Temp\78F7.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7A00.tmp"C:\Users\Admin\AppData\Local\Temp\7A00.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"C:\Users\Admin\AppData\Local\Temp\7A6D.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"C:\Users\Admin\AppData\Local\Temp\7AEA.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7B57.tmp"C:\Users\Admin\AppData\Local\Temp\7B57.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\7C41.tmp"C:\Users\Admin\AppData\Local\Temp\7C41.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"C:\Users\Admin\AppData\Local\Temp\7CBE.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"C:\Users\Admin\AppData\Local\Temp\7D3B.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\818F.tmp"C:\Users\Admin\AppData\Local\Temp\818F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\820B.tmp"C:\Users\Admin\AppData\Local\Temp\820B.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\8382.tmp"C:\Users\Admin\AppData\Local\Temp\8382.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\846C.tmp"C:\Users\Admin\AppData\Local\Temp\846C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\84AA.tmp"C:\Users\Admin\AppData\Local\Temp\84AA.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\8537.tmp"C:\Users\Admin\AppData\Local\Temp\8537.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:332 -
C:\Users\Admin\AppData\Local\Temp\8575.tmp"C:\Users\Admin\AppData\Local\Temp\8575.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\85B3.tmp"C:\Users\Admin\AppData\Local\Temp\85B3.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\85F2.tmp"C:\Users\Admin\AppData\Local\Temp\85F2.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\8640.tmp"C:\Users\Admin\AppData\Local\Temp\8640.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\890D.tmp"C:\Users\Admin\AppData\Local\Temp\890D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"C:\Users\Admin\AppData\Local\Temp\8AB3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"C:\Users\Admin\AppData\Local\Temp\8BAC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8C29.tmp"C:\Users\Admin\AppData\Local\Temp\8C29.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\8C67.tmp"C:\Users\Admin\AppData\Local\Temp\8C67.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"65⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"66⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"67⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"68⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"69⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"70⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"71⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"72⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\8F73.tmp"C:\Users\Admin\AppData\Local\Temp\8F73.tmp"73⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"74⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\9000.tmp"C:\Users\Admin\AppData\Local\Temp\9000.tmp"75⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\903E.tmp"C:\Users\Admin\AppData\Local\Temp\903E.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\907D.tmp"C:\Users\Admin\AppData\Local\Temp\907D.tmp"77⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\90CB.tmp"C:\Users\Admin\AppData\Local\Temp\90CB.tmp"78⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"79⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\9147.tmp"C:\Users\Admin\AppData\Local\Temp\9147.tmp"80⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\9186.tmp"C:\Users\Admin\AppData\Local\Temp\9186.tmp"81⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\91C4.tmp"C:\Users\Admin\AppData\Local\Temp\91C4.tmp"82⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\9203.tmp"C:\Users\Admin\AppData\Local\Temp\9203.tmp"83⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\9241.tmp"C:\Users\Admin\AppData\Local\Temp\9241.tmp"84⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\927F.tmp"C:\Users\Admin\AppData\Local\Temp\927F.tmp"85⤵
- System Location Discovery: System Language Discovery
PID:268 -
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"86⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"87⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\933B.tmp"C:\Users\Admin\AppData\Local\Temp\933B.tmp"88⤵PID:1328
-
C:\Users\Admin\AppData\Local\Temp\9379.tmp"C:\Users\Admin\AppData\Local\Temp\9379.tmp"89⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\93B7.tmp"C:\Users\Admin\AppData\Local\Temp\93B7.tmp"90⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\93F6.tmp"C:\Users\Admin\AppData\Local\Temp\93F6.tmp"91⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\9434.tmp"C:\Users\Admin\AppData\Local\Temp\9434.tmp"92⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\9473.tmp"C:\Users\Admin\AppData\Local\Temp\9473.tmp"93⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\94B1.tmp"C:\Users\Admin\AppData\Local\Temp\94B1.tmp"94⤵
- System Location Discovery: System Language Discovery
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"95⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\952E.tmp"C:\Users\Admin\AppData\Local\Temp\952E.tmp"96⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\956C.tmp"C:\Users\Admin\AppData\Local\Temp\956C.tmp"97⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\95AB.tmp"C:\Users\Admin\AppData\Local\Temp\95AB.tmp"98⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\95E9.tmp"C:\Users\Admin\AppData\Local\Temp\95E9.tmp"99⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\9627.tmp"C:\Users\Admin\AppData\Local\Temp\9627.tmp"100⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\9666.tmp"C:\Users\Admin\AppData\Local\Temp\9666.tmp"101⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\96A4.tmp"C:\Users\Admin\AppData\Local\Temp\96A4.tmp"102⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"103⤵
- System Location Discovery: System Language Discovery
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"104⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"105⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"106⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"107⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"108⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"109⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"110⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"111⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9924.tmp"C:\Users\Admin\AppData\Local\Temp\9924.tmp"112⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"113⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\99A1.tmp"C:\Users\Admin\AppData\Local\Temp\99A1.tmp"114⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\99DF.tmp"C:\Users\Admin\AppData\Local\Temp\99DF.tmp"115⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"116⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"C:\Users\Admin\AppData\Local\Temp\9A5C.tmp"117⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"119⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"120⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"121⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"C:\Users\Admin\AppData\Local\Temp\9BA3.tmp"122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-