Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe
-
Size
520KB
-
MD5
51dbe3ae2862b2d0cf78a3e06e7a4e9b
-
SHA1
de63456f253f0589e71867eebbec399da4b6f259
-
SHA256
0c6dceb27e21236ebfa4ac6454b5a9cefa1dd6788fe3716dc2d6ea1348a78734
-
SHA512
6c021df7465da968e695b28325ed9811239615b773486a4a98ac2dd4b66541f3d7475fdbb5c6d7ef025391d28c65ed536c36853a131c77a73c1b9f211400220f
-
SSDEEP
12288:roRXOQjmOy9uSfKyK81wGFZtbMvSGoTI4iFNZ:rogQ9yuy1ZtbM6J0N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2708 EA9D.tmp 2820 EB1A.tmp 2564 EB78.tmp 2392 EBF4.tmp 2580 EC42.tmp 2672 ECB0.tmp 2576 ED2C.tmp 1080 ED9A.tmp 2248 EE16.tmp 1544 EE93.tmp 2904 EF00.tmp 2952 EF7D.tmp 2596 F00A.tmp 2748 F077.tmp 1508 F0D4.tmp 304 F151.tmp 2036 F1CE.tmp 2032 F24B.tmp 2868 F2C8.tmp 1740 F344.tmp 1584 F3A2.tmp 3000 F41F.tmp 1632 F48C.tmp 2168 F4CA.tmp 2204 F509.tmp 1880 F557.tmp 2164 F595.tmp 1628 F5D4.tmp 788 F612.tmp 2364 F660.tmp 700 F6AE.tmp 1316 F6EC.tmp 1920 F72B.tmp 1820 F769.tmp 792 F7B7.tmp 1668 F805.tmp 1692 F853.tmp 1556 F892.tmp 2656 F8E0.tmp 1720 F92E.tmp 916 F97C.tmp 2064 F9BA.tmp 2344 F9F8.tmp 2196 FA46.tmp 2456 FA85.tmp 1768 FAD3.tmp 1092 FB21.tmp 1520 FB6F.tmp 1000 FBAD.tmp 2480 FBEC.tmp 3044 FC2A.tmp 2668 FC78.tmp 1596 FCC6.tmp 2772 FD04.tmp 2776 FD52.tmp 2784 FDCF.tmp 2304 FE1D.tmp 2864 FE7B.tmp 2392 FEF8.tmp 1424 FF46.tmp 2580 FF94.tmp 1828 FFF1.tmp 2636 4F.tmp 3060 9D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2432 2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe 2708 EA9D.tmp 2820 EB1A.tmp 2564 EB78.tmp 2392 EBF4.tmp 2580 EC42.tmp 2672 ECB0.tmp 2576 ED2C.tmp 1080 ED9A.tmp 2248 EE16.tmp 1544 EE93.tmp 2904 EF00.tmp 2952 EF7D.tmp 2596 F00A.tmp 2748 F077.tmp 1508 F0D4.tmp 304 F151.tmp 2036 F1CE.tmp 2032 F24B.tmp 2868 F2C8.tmp 1740 F344.tmp 1584 F3A2.tmp 3000 F41F.tmp 1632 F48C.tmp 2168 F4CA.tmp 2204 F509.tmp 1880 F557.tmp 2164 F595.tmp 1628 F5D4.tmp 788 F612.tmp 2364 F660.tmp 700 F6AE.tmp 1316 F6EC.tmp 1920 F72B.tmp 1820 F769.tmp 792 F7B7.tmp 1668 F805.tmp 1692 F853.tmp 1556 F892.tmp 2656 F8E0.tmp 1720 F92E.tmp 916 F97C.tmp 2064 F9BA.tmp 2344 F9F8.tmp 2196 FA46.tmp 2456 FA85.tmp 1768 FAD3.tmp 1092 FB21.tmp 1520 FB6F.tmp 1000 FBAD.tmp 2480 FBEC.tmp 3044 FC2A.tmp 2668 FC78.tmp 1596 FCC6.tmp 2772 FD04.tmp 2776 FD52.tmp 2784 FDCF.tmp 2304 FE1D.tmp 2864 FE7B.tmp 2392 FEF8.tmp 1424 FF46.tmp 2580 FF94.tmp 1828 FFF1.tmp 2636 4F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 712A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F344.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A3A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 168.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B912.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2858.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7178.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 622D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BCF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 61EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9924.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED6B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 934.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8305.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F400.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BF0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 427C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 956C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 229E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA1B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2432 wrote to memory of 2708 2432 2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe 31 PID 2432 wrote to memory of 2708 2432 2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe 31 PID 2432 wrote to memory of 2708 2432 2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe 31 PID 2432 wrote to memory of 2708 2432 2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe 31 PID 2708 wrote to memory of 2820 2708 EA9D.tmp 32 PID 2708 wrote to memory of 2820 2708 EA9D.tmp 32 PID 2708 wrote to memory of 2820 2708 EA9D.tmp 32 PID 2708 wrote to memory of 2820 2708 EA9D.tmp 32 PID 2820 wrote to memory of 2564 2820 EB1A.tmp 33 PID 2820 wrote to memory of 2564 2820 EB1A.tmp 33 PID 2820 wrote to memory of 2564 2820 EB1A.tmp 33 PID 2820 wrote to memory of 2564 2820 EB1A.tmp 33 PID 2564 wrote to memory of 2392 2564 EB78.tmp 34 PID 2564 wrote to memory of 2392 2564 EB78.tmp 34 PID 2564 wrote to memory of 2392 2564 EB78.tmp 34 PID 2564 wrote to memory of 2392 2564 EB78.tmp 34 PID 2392 wrote to memory of 2580 2392 EBF4.tmp 35 PID 2392 wrote to memory of 2580 2392 EBF4.tmp 35 PID 2392 wrote to memory of 2580 2392 EBF4.tmp 35 PID 2392 wrote to memory of 2580 2392 EBF4.tmp 35 PID 2580 wrote to memory of 2672 2580 EC42.tmp 36 PID 2580 wrote to memory of 2672 2580 EC42.tmp 36 PID 2580 wrote to memory of 2672 2580 EC42.tmp 36 PID 2580 wrote to memory of 2672 2580 EC42.tmp 36 PID 2672 wrote to memory of 2576 2672 ECB0.tmp 37 PID 2672 wrote to memory of 2576 2672 ECB0.tmp 37 PID 2672 wrote to memory of 2576 2672 ECB0.tmp 37 PID 2672 wrote to memory of 2576 2672 ECB0.tmp 37 PID 2576 wrote to memory of 1080 2576 ED2C.tmp 38 PID 2576 wrote to memory of 1080 2576 ED2C.tmp 38 PID 2576 wrote to memory of 1080 2576 ED2C.tmp 38 PID 2576 wrote to memory of 1080 2576 ED2C.tmp 38 PID 1080 wrote to memory of 2248 1080 ED9A.tmp 39 PID 1080 wrote to memory of 2248 1080 ED9A.tmp 39 PID 1080 wrote to memory of 2248 1080 ED9A.tmp 39 PID 1080 wrote to memory of 2248 1080 ED9A.tmp 39 PID 2248 wrote to memory of 1544 2248 EE16.tmp 40 PID 2248 wrote to memory of 1544 2248 EE16.tmp 40 PID 2248 wrote to memory of 1544 2248 EE16.tmp 40 PID 2248 wrote to memory of 1544 2248 EE16.tmp 40 PID 1544 wrote to memory of 2904 1544 EE93.tmp 41 PID 1544 wrote to memory of 2904 1544 EE93.tmp 41 PID 1544 wrote to memory of 2904 1544 EE93.tmp 41 PID 1544 wrote to memory of 2904 1544 EE93.tmp 41 PID 2904 wrote to memory of 2952 2904 EF00.tmp 42 PID 2904 wrote to memory of 2952 2904 EF00.tmp 42 PID 2904 wrote to memory of 2952 2904 EF00.tmp 42 PID 2904 wrote to memory of 2952 2904 EF00.tmp 42 PID 2952 wrote to memory of 2596 2952 EF7D.tmp 43 PID 2952 wrote to memory of 2596 2952 EF7D.tmp 43 PID 2952 wrote to memory of 2596 2952 EF7D.tmp 43 PID 2952 wrote to memory of 2596 2952 EF7D.tmp 43 PID 2596 wrote to memory of 2748 2596 F00A.tmp 44 PID 2596 wrote to memory of 2748 2596 F00A.tmp 44 PID 2596 wrote to memory of 2748 2596 F00A.tmp 44 PID 2596 wrote to memory of 2748 2596 F00A.tmp 44 PID 2748 wrote to memory of 1508 2748 F077.tmp 45 PID 2748 wrote to memory of 1508 2748 F077.tmp 45 PID 2748 wrote to memory of 1508 2748 F077.tmp 45 PID 2748 wrote to memory of 1508 2748 F077.tmp 45 PID 1508 wrote to memory of 304 1508 F0D4.tmp 46 PID 1508 wrote to memory of 304 1508 F0D4.tmp 46 PID 1508 wrote to memory of 304 1508 F0D4.tmp 46 PID 1508 wrote to memory of 304 1508 F0D4.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_51dbe3ae2862b2d0cf78a3e06e7a4e9b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"C:\Users\Admin\AppData\Local\Temp\EB1A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\EB78.tmp"C:\Users\Admin\AppData\Local\Temp\EB78.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"C:\Users\Admin\AppData\Local\Temp\ECB0.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"C:\Users\Admin\AppData\Local\Temp\ED2C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"C:\Users\Admin\AppData\Local\Temp\ED9A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\EE16.tmp"C:\Users\Admin\AppData\Local\Temp\EE16.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\EF00.tmp"C:\Users\Admin\AppData\Local\Temp\EF00.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F00A.tmp"C:\Users\Admin\AppData\Local\Temp\F00A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"C:\Users\Admin\AppData\Local\Temp\F0D4.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\F151.tmp"C:\Users\Admin\AppData\Local\Temp\F151.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:304 -
C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"C:\Users\Admin\AppData\Local\Temp\F1CE.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\F24B.tmp"C:\Users\Admin\AppData\Local\Temp\F24B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"C:\Users\Admin\AppData\Local\Temp\F3A2.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\F48C.tmp"C:\Users\Admin\AppData\Local\Temp\F48C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\F595.tmp"C:\Users\Admin\AppData\Local\Temp\F595.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"C:\Users\Admin\AppData\Local\Temp\F5D4.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\F612.tmp"C:\Users\Admin\AppData\Local\Temp\F612.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:788 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:700 -
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"C:\Users\Admin\AppData\Local\Temp\F7B7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:792 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\F853.tmp"C:\Users\Admin\AppData\Local\Temp\F853.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\F892.tmp"C:\Users\Admin\AppData\Local\Temp\F892.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\F97C.tmp"C:\Users\Admin\AppData\Local\Temp\F97C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"C:\Users\Admin\AppData\Local\Temp\F9BA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"C:\Users\Admin\AppData\Local\Temp\F9F8.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\FA46.tmp"C:\Users\Admin\AppData\Local\Temp\FA46.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\FA85.tmp"C:\Users\Admin\AppData\Local\Temp\FA85.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\FC78.tmp"C:\Users\Admin\AppData\Local\Temp\FC78.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"C:\Users\Admin\AppData\Local\Temp\FCC6.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\FD04.tmp"C:\Users\Admin\AppData\Local\Temp\FD04.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"C:\Users\Admin\AppData\Local\Temp\FDCF.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\FF46.tmp"C:\Users\Admin\AppData\Local\Temp\FF46.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\9D.tmp"C:\Users\Admin\AppData\Local\Temp\9D.tmp"65⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\DB.tmp"C:\Users\Admin\AppData\Local\Temp\DB.tmp"66⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\129.tmp"C:\Users\Admin\AppData\Local\Temp\129.tmp"67⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\168.tmp"C:\Users\Admin\AppData\Local\Temp\168.tmp"68⤵
- System Location Discovery: System Language Discovery
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"69⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"70⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"71⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"72⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\2DE.tmp"C:\Users\Admin\AppData\Local\Temp\2DE.tmp"73⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"74⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\38A.tmp"C:\Users\Admin\AppData\Local\Temp\38A.tmp"75⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"76⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\416.tmp"C:\Users\Admin\AppData\Local\Temp\416.tmp"77⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"78⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"79⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\4E1.tmp"C:\Users\Admin\AppData\Local\Temp\4E1.tmp"80⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"81⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\56D.tmp"C:\Users\Admin\AppData\Local\Temp\56D.tmp"82⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"83⤵PID:604
-
C:\Users\Admin\AppData\Local\Temp\609.tmp"C:\Users\Admin\AppData\Local\Temp\609.tmp"84⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"85⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"86⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"87⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\722.tmp"C:\Users\Admin\AppData\Local\Temp\722.tmp"88⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"89⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\7BE.tmp"C:\Users\Admin\AppData\Local\Temp\7BE.tmp"90⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"91⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"92⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\8A8.tmp"C:\Users\Admin\AppData\Local\Temp\8A8.tmp"93⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"94⤵PID:788
-
C:\Users\Admin\AppData\Local\Temp\934.tmp"C:\Users\Admin\AppData\Local\Temp\934.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\973.tmp"C:\Users\Admin\AppData\Local\Temp\973.tmp"96⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"97⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"98⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\A3E.tmp"C:\Users\Admin\AppData\Local\Temp\A3E.tmp"99⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"100⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"101⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"102⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"103⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"104⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\C31.tmp"C:\Users\Admin\AppData\Local\Temp\C31.tmp"105⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"106⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"107⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"108⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"109⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\D78.tmp"C:\Users\Admin\AppData\Local\Temp\D78.tmp"110⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"111⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"112⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"113⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"114⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"115⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"116⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\F6C.tmp"C:\Users\Admin\AppData\Local\Temp\F6C.tmp"117⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"118⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"119⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"120⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"121⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"122⤵PID:2756
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-