Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe
-
Size
712KB
-
MD5
1d5ff9970f32278294b737bda2e34265
-
SHA1
c58a8ea803ccd3cc1757dc7d71f4926b5e83ae56
-
SHA256
dd5b7a92aa70e92473e41d6f80caf25f263d7070766f6f391452ea938302ac48
-
SHA512
8588e5778eb3c134f52db9438db79e2319ef6571902bdba919de295087e71f06c3b8f8d00ce2b213fb6d340baa077c6de9b380b0e4d5e59fe00f8941dffbec98
-
SSDEEP
12288:FU5rCOTeiDY7riHNB7w28DdlIFZ/OwtsXNZdCvq5TJLCvY90D8/LVBlVk736Y79m:FUQOJDY7OHPw2O7IFZmHNnCvq5TJLCvc
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2488 B52C.tmp 3040 B599.tmp 1892 B616.tmp 2764 B693.tmp 536 B6F0.tmp 2864 B74E.tmp 3000 B7BB.tmp 2316 B838.tmp 2844 B8A5.tmp 2604 B912.tmp 864 B97F.tmp 2608 B9CD.tmp 2132 BA3B.tmp 2212 BAA8.tmp 1704 BB15.tmp 2788 BB82.tmp 1868 BBEF.tmp 2780 BC5D.tmp 400 BCCA.tmp 2768 BD37.tmp 952 BDA4.tmp 1904 BE21.tmp 2952 BE7F.tmp 2664 BEBD.tmp 2672 BF0B.tmp 1860 BF49.tmp 2948 BF97.tmp 2616 BFD6.tmp 1312 C014.tmp 2964 C053.tmp 444 C091.tmp 3008 C0CF.tmp 1672 C10E.tmp 1752 C14C.tmp 1080 C18B.tmp 1540 C1C9.tmp 2068 C207.tmp 1692 C246.tmp 1832 C284.tmp 856 C2C3.tmp 1572 C301.tmp 612 C33F.tmp 776 C37E.tmp 1048 C3BC.tmp 2336 C3FB.tmp 852 C439.tmp 1724 C487.tmp 2236 C4D5.tmp 1912 C513.tmp 1612 C552.tmp 320 C5A0.tmp 1556 C5DE.tmp 1592 C62C.tmp 2376 C66B.tmp 2508 C6A9.tmp 2312 C6E7.tmp 2088 C726.tmp 1796 C764.tmp 2016 C7A3.tmp 2724 C7E1.tmp 536 C81F.tmp 2584 C86D.tmp 2992 C8AC.tmp 2888 C8EA.tmp -
Loads dropped DLL 64 IoCs
pid Process 2104 2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe 2488 B52C.tmp 3040 B599.tmp 1892 B616.tmp 2764 B693.tmp 536 B6F0.tmp 2864 B74E.tmp 3000 B7BB.tmp 2316 B838.tmp 2844 B8A5.tmp 2604 B912.tmp 864 B97F.tmp 2608 B9CD.tmp 2132 BA3B.tmp 2212 BAA8.tmp 1704 BB15.tmp 2788 BB82.tmp 1868 BBEF.tmp 2780 BC5D.tmp 400 BCCA.tmp 2768 BD37.tmp 952 BDA4.tmp 1904 BE21.tmp 2952 BE7F.tmp 2664 BEBD.tmp 2672 BF0B.tmp 1860 BF49.tmp 2948 BF97.tmp 2616 BFD6.tmp 1312 C014.tmp 2964 C053.tmp 444 C091.tmp 3008 C0CF.tmp 1672 C10E.tmp 1752 C14C.tmp 1080 C18B.tmp 1540 C1C9.tmp 2068 C207.tmp 1692 C246.tmp 1832 C284.tmp 856 C2C3.tmp 1572 C301.tmp 612 C33F.tmp 776 C37E.tmp 1048 C3BC.tmp 2336 C3FB.tmp 852 C439.tmp 1724 C487.tmp 2236 C4D5.tmp 1912 C513.tmp 1612 C552.tmp 320 C5A0.tmp 1556 C5DE.tmp 1592 C62C.tmp 2376 C66B.tmp 2508 C6A9.tmp 2312 C6E7.tmp 2088 C726.tmp 1796 C764.tmp 2016 C7A3.tmp 2724 C7E1.tmp 536 C81F.tmp 2584 C86D.tmp 2992 C8AC.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EFCB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAFD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ABD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6097.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9721.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 580F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6114.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6ED9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EF8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA11.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 82A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E1E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AB3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 676A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3B1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F21.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7668.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7ABB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D375.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5754.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C93.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2104 wrote to memory of 2488 2104 2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe 30 PID 2104 wrote to memory of 2488 2104 2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe 30 PID 2104 wrote to memory of 2488 2104 2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe 30 PID 2104 wrote to memory of 2488 2104 2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe 30 PID 2488 wrote to memory of 3040 2488 B52C.tmp 31 PID 2488 wrote to memory of 3040 2488 B52C.tmp 31 PID 2488 wrote to memory of 3040 2488 B52C.tmp 31 PID 2488 wrote to memory of 3040 2488 B52C.tmp 31 PID 3040 wrote to memory of 1892 3040 B599.tmp 32 PID 3040 wrote to memory of 1892 3040 B599.tmp 32 PID 3040 wrote to memory of 1892 3040 B599.tmp 32 PID 3040 wrote to memory of 1892 3040 B599.tmp 32 PID 1892 wrote to memory of 2764 1892 B616.tmp 33 PID 1892 wrote to memory of 2764 1892 B616.tmp 33 PID 1892 wrote to memory of 2764 1892 B616.tmp 33 PID 1892 wrote to memory of 2764 1892 B616.tmp 33 PID 2764 wrote to memory of 536 2764 B693.tmp 34 PID 2764 wrote to memory of 536 2764 B693.tmp 34 PID 2764 wrote to memory of 536 2764 B693.tmp 34 PID 2764 wrote to memory of 536 2764 B693.tmp 34 PID 536 wrote to memory of 2864 536 B6F0.tmp 35 PID 536 wrote to memory of 2864 536 B6F0.tmp 35 PID 536 wrote to memory of 2864 536 B6F0.tmp 35 PID 536 wrote to memory of 2864 536 B6F0.tmp 35 PID 2864 wrote to memory of 3000 2864 B74E.tmp 36 PID 2864 wrote to memory of 3000 2864 B74E.tmp 36 PID 2864 wrote to memory of 3000 2864 B74E.tmp 36 PID 2864 wrote to memory of 3000 2864 B74E.tmp 36 PID 3000 wrote to memory of 2316 3000 B7BB.tmp 37 PID 3000 wrote to memory of 2316 3000 B7BB.tmp 37 PID 3000 wrote to memory of 2316 3000 B7BB.tmp 37 PID 3000 wrote to memory of 2316 3000 B7BB.tmp 37 PID 2316 wrote to memory of 2844 2316 B838.tmp 38 PID 2316 wrote to memory of 2844 2316 B838.tmp 38 PID 2316 wrote to memory of 2844 2316 B838.tmp 38 PID 2316 wrote to memory of 2844 2316 B838.tmp 38 PID 2844 wrote to memory of 2604 2844 B8A5.tmp 39 PID 2844 wrote to memory of 2604 2844 B8A5.tmp 39 PID 2844 wrote to memory of 2604 2844 B8A5.tmp 39 PID 2844 wrote to memory of 2604 2844 B8A5.tmp 39 PID 2604 wrote to memory of 864 2604 B912.tmp 40 PID 2604 wrote to memory of 864 2604 B912.tmp 40 PID 2604 wrote to memory of 864 2604 B912.tmp 40 PID 2604 wrote to memory of 864 2604 B912.tmp 40 PID 864 wrote to memory of 2608 864 B97F.tmp 41 PID 864 wrote to memory of 2608 864 B97F.tmp 41 PID 864 wrote to memory of 2608 864 B97F.tmp 41 PID 864 wrote to memory of 2608 864 B97F.tmp 41 PID 2608 wrote to memory of 2132 2608 B9CD.tmp 42 PID 2608 wrote to memory of 2132 2608 B9CD.tmp 42 PID 2608 wrote to memory of 2132 2608 B9CD.tmp 42 PID 2608 wrote to memory of 2132 2608 B9CD.tmp 42 PID 2132 wrote to memory of 2212 2132 BA3B.tmp 43 PID 2132 wrote to memory of 2212 2132 BA3B.tmp 43 PID 2132 wrote to memory of 2212 2132 BA3B.tmp 43 PID 2132 wrote to memory of 2212 2132 BA3B.tmp 43 PID 2212 wrote to memory of 1704 2212 BAA8.tmp 44 PID 2212 wrote to memory of 1704 2212 BAA8.tmp 44 PID 2212 wrote to memory of 1704 2212 BAA8.tmp 44 PID 2212 wrote to memory of 1704 2212 BAA8.tmp 44 PID 1704 wrote to memory of 2788 1704 BB15.tmp 45 PID 1704 wrote to memory of 2788 1704 BB15.tmp 45 PID 1704 wrote to memory of 2788 1704 BB15.tmp 45 PID 1704 wrote to memory of 2788 1704 BB15.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-08_1d5ff9970f32278294b737bda2e34265_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\B599.tmp"C:\Users\Admin\AppData\Local\Temp\B599.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B616.tmp"C:\Users\Admin\AppData\Local\Temp\B616.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\B693.tmp"C:\Users\Admin\AppData\Local\Temp\B693.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\B74E.tmp"C:\Users\Admin\AppData\Local\Temp\B74E.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"C:\Users\Admin\AppData\Local\Temp\BAA8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"C:\Users\Admin\AppData\Local\Temp\BC5D.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:400 -
C:\Users\Admin\AppData\Local\Temp\BD37.tmp"C:\Users\Admin\AppData\Local\Temp\BD37.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"C:\Users\Admin\AppData\Local\Temp\BF0B.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"C:\Users\Admin\AppData\Local\Temp\C0CF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\C284.tmp"C:\Users\Admin\AppData\Local\Temp\C284.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\C33F.tmp"C:\Users\Admin\AppData\Local\Temp\C33F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:612 -
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\C552.tmp"C:\Users\Admin\AppData\Local\Temp\C552.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"C:\Users\Admin\AppData\Local\Temp\C5A0.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"C:\Users\Admin\AppData\Local\Temp\C5DE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\C764.tmp"C:\Users\Admin\AppData\Local\Temp\C764.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:536 -
C:\Users\Admin\AppData\Local\Temp\C86D.tmp"C:\Users\Admin\AppData\Local\Temp\C86D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"C:\Users\Admin\AppData\Local\Temp\C8AC.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"C:\Users\Admin\AppData\Local\Temp\C8EA.tmp"65⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\C929.tmp"C:\Users\Admin\AppData\Local\Temp\C929.tmp"66⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"67⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"68⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"70⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"71⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"72⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"73⤵
- System Location Discovery: System Language Discovery
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"74⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"75⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"76⤵
- System Location Discovery: System Language Discovery
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"77⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"78⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"79⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"80⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"81⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"82⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"C:\Users\Admin\AppData\Local\Temp\CD8C.tmp"83⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"C:\Users\Admin\AppData\Local\Temp\CDCA.tmp"84⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\CE09.tmp"C:\Users\Admin\AppData\Local\Temp\CE09.tmp"85⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\CE47.tmp"C:\Users\Admin\AppData\Local\Temp\CE47.tmp"86⤵
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\CE85.tmp"C:\Users\Admin\AppData\Local\Temp\CE85.tmp"87⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"C:\Users\Admin\AppData\Local\Temp\CEC4.tmp"88⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\CF02.tmp"C:\Users\Admin\AppData\Local\Temp\CF02.tmp"89⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\CF41.tmp"C:\Users\Admin\AppData\Local\Temp\CF41.tmp"90⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"C:\Users\Admin\AppData\Local\Temp\CF7F.tmp"91⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"C:\Users\Admin\AppData\Local\Temp\CFBD.tmp"92⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFFC.tmp"93⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\D03A.tmp"C:\Users\Admin\AppData\Local\Temp\D03A.tmp"94⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"95⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"96⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"97⤵PID:308
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"98⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"99⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"100⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"101⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"102⤵PID:896
-
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"103⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"104⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"105⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"106⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"109⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"110⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"111⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"112⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"113⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\D539.tmp"C:\Users\Admin\AppData\Local\Temp\D539.tmp"114⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"C:\Users\Admin\AppData\Local\Temp\D5C6.tmp"116⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\D604.tmp"C:\Users\Admin\AppData\Local\Temp\D604.tmp"117⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\D643.tmp"C:\Users\Admin\AppData\Local\Temp\D643.tmp"118⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\D681.tmp"C:\Users\Admin\AppData\Local\Temp\D681.tmp"119⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"C:\Users\Admin\AppData\Local\Temp\D6CF.tmp"120⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\D70D.tmp"C:\Users\Admin\AppData\Local\Temp\D70D.tmp"121⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\D74C.tmp"C:\Users\Admin\AppData\Local\Temp\D74C.tmp"122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-