Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 03:54 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe
-
Size
712KB
-
MD5
50de947d20035e0d489eb0ef6f8b844e
-
SHA1
2ef1cc2dfeeff816d519dc5cc5aab8f820a209d2
-
SHA256
017eed220c7b168a0b8321c47d706683e43ad2389b8396ecaf82163c21b04e45
-
SHA512
0bfdc816ffea063d17b2fb8f541e3cceed358f7f13cc0a6f7bd41dfbe7b05ffe0ad73eae895b6d02feeef1200897cb2b1581b1d3e3b94a6545f3317bd61f47f9
-
SSDEEP
12288:FU5rCOTeiDp8IjWv8hX6YKVN4qNbWYjNZdCvq5TJLCvY90D8/LVBlVk736Y79GWm:FUQOJDLjWvNYKrRWYjNnCvq5TJLCvY93
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2028 AE87.tmp 2160 AF04.tmp 2312 AF81.tmp 2704 AFEE.tmp 2724 B05B.tmp 2864 B0C9.tmp 2740 B126.tmp 2492 B193.tmp 2064 B201.tmp 2812 B26E.tmp 1656 B2DB.tmp 2644 B348.tmp 2268 B3B5.tmp 1620 B432.tmp 876 B490.tmp 1900 B50D.tmp 2912 B57A.tmp 2440 B606.tmp 2352 B654.tmp 1512 B6D1.tmp 1184 B73E.tmp 2892 B7BB.tmp 1324 B819.tmp 2932 B857.tmp 2976 B895.tmp 2924 B8D4.tmp 2236 B912.tmp 2272 B951.tmp 984 B98F.tmp 3064 B9DD.tmp 2936 BA1B.tmp 1096 BA5A.tmp 2428 BA98.tmp 828 BAD7.tmp 1268 BB15.tmp 1152 BB53.tmp 856 BB92.tmp 1464 BBD0.tmp 2184 BC0F.tmp 1896 BC4D.tmp 1468 BC8B.tmp 1604 BCCA.tmp 900 BD08.tmp 1632 BD47.tmp 2556 BD85.tmp 1484 BDC3.tmp 992 BE02.tmp 2476 BE40.tmp 1948 BE7F.tmp 884 BEBD.tmp 2372 BEFB.tmp 2144 BF49.tmp 2384 BFD6.tmp 2284 C014.tmp 2028 C053.tmp 1680 C0A1.tmp 2012 C0DF.tmp 1408 C11D.tmp 2744 C15C.tmp 2868 C1AA.tmp 2756 C1E8.tmp 2848 C227.tmp 2748 C275.tmp 2020 C2B3.tmp -
Loads dropped DLL 64 IoCs
pid Process 2384 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 2028 AE87.tmp 2160 AF04.tmp 2312 AF81.tmp 2704 AFEE.tmp 2724 B05B.tmp 2864 B0C9.tmp 2740 B126.tmp 2492 B193.tmp 2064 B201.tmp 2812 B26E.tmp 1656 B2DB.tmp 2644 B348.tmp 2268 B3B5.tmp 1620 B432.tmp 876 B490.tmp 1900 B50D.tmp 2912 B57A.tmp 2440 B606.tmp 2352 B654.tmp 1512 B6D1.tmp 1184 B73E.tmp 2892 B7BB.tmp 1324 B819.tmp 2932 B857.tmp 2976 B895.tmp 2924 B8D4.tmp 2236 B912.tmp 2272 B951.tmp 984 B98F.tmp 3064 B9DD.tmp 2936 BA1B.tmp 1096 BA5A.tmp 2428 BA98.tmp 828 BAD7.tmp 1268 BB15.tmp 1152 BB53.tmp 856 BB92.tmp 1464 BBD0.tmp 2184 BC0F.tmp 1896 BC4D.tmp 1468 BC8B.tmp 1604 BCCA.tmp 900 BD08.tmp 1632 BD47.tmp 2556 BD85.tmp 1484 BDC3.tmp 992 BE02.tmp 2476 BE40.tmp 1948 BE7F.tmp 884 BEBD.tmp 2372 BEFB.tmp 1636 BF88.tmp 2384 BFD6.tmp 2284 C014.tmp 2028 C053.tmp 1680 C0A1.tmp 2012 C0DF.tmp 1408 C11D.tmp 2744 C15C.tmp 2868 C1AA.tmp 2756 C1E8.tmp 2848 C227.tmp 2748 C275.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F631.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2443.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5293.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C62C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DEA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5689.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A69B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D643.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F383.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4605.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A13F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EA7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CBD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2028 2384 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 30 PID 2384 wrote to memory of 2028 2384 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 30 PID 2384 wrote to memory of 2028 2384 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 30 PID 2384 wrote to memory of 2028 2384 2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe 30 PID 2028 wrote to memory of 2160 2028 AE87.tmp 31 PID 2028 wrote to memory of 2160 2028 AE87.tmp 31 PID 2028 wrote to memory of 2160 2028 AE87.tmp 31 PID 2028 wrote to memory of 2160 2028 AE87.tmp 31 PID 2160 wrote to memory of 2312 2160 AF04.tmp 32 PID 2160 wrote to memory of 2312 2160 AF04.tmp 32 PID 2160 wrote to memory of 2312 2160 AF04.tmp 32 PID 2160 wrote to memory of 2312 2160 AF04.tmp 32 PID 2312 wrote to memory of 2704 2312 AF81.tmp 33 PID 2312 wrote to memory of 2704 2312 AF81.tmp 33 PID 2312 wrote to memory of 2704 2312 AF81.tmp 33 PID 2312 wrote to memory of 2704 2312 AF81.tmp 33 PID 2704 wrote to memory of 2724 2704 AFEE.tmp 34 PID 2704 wrote to memory of 2724 2704 AFEE.tmp 34 PID 2704 wrote to memory of 2724 2704 AFEE.tmp 34 PID 2704 wrote to memory of 2724 2704 AFEE.tmp 34 PID 2724 wrote to memory of 2864 2724 B05B.tmp 35 PID 2724 wrote to memory of 2864 2724 B05B.tmp 35 PID 2724 wrote to memory of 2864 2724 B05B.tmp 35 PID 2724 wrote to memory of 2864 2724 B05B.tmp 35 PID 2864 wrote to memory of 2740 2864 B0C9.tmp 36 PID 2864 wrote to memory of 2740 2864 B0C9.tmp 36 PID 2864 wrote to memory of 2740 2864 B0C9.tmp 36 PID 2864 wrote to memory of 2740 2864 B0C9.tmp 36 PID 2740 wrote to memory of 2492 2740 B126.tmp 37 PID 2740 wrote to memory of 2492 2740 B126.tmp 37 PID 2740 wrote to memory of 2492 2740 B126.tmp 37 PID 2740 wrote to memory of 2492 2740 B126.tmp 37 PID 2492 wrote to memory of 2064 2492 B193.tmp 38 PID 2492 wrote to memory of 2064 2492 B193.tmp 38 PID 2492 wrote to memory of 2064 2492 B193.tmp 38 PID 2492 wrote to memory of 2064 2492 B193.tmp 38 PID 2064 wrote to memory of 2812 2064 B201.tmp 39 PID 2064 wrote to memory of 2812 2064 B201.tmp 39 PID 2064 wrote to memory of 2812 2064 B201.tmp 39 PID 2064 wrote to memory of 2812 2064 B201.tmp 39 PID 2812 wrote to memory of 1656 2812 B26E.tmp 40 PID 2812 wrote to memory of 1656 2812 B26E.tmp 40 PID 2812 wrote to memory of 1656 2812 B26E.tmp 40 PID 2812 wrote to memory of 1656 2812 B26E.tmp 40 PID 1656 wrote to memory of 2644 1656 B2DB.tmp 41 PID 1656 wrote to memory of 2644 1656 B2DB.tmp 41 PID 1656 wrote to memory of 2644 1656 B2DB.tmp 41 PID 1656 wrote to memory of 2644 1656 B2DB.tmp 41 PID 2644 wrote to memory of 2268 2644 B348.tmp 42 PID 2644 wrote to memory of 2268 2644 B348.tmp 42 PID 2644 wrote to memory of 2268 2644 B348.tmp 42 PID 2644 wrote to memory of 2268 2644 B348.tmp 42 PID 2268 wrote to memory of 1620 2268 B3B5.tmp 43 PID 2268 wrote to memory of 1620 2268 B3B5.tmp 43 PID 2268 wrote to memory of 1620 2268 B3B5.tmp 43 PID 2268 wrote to memory of 1620 2268 B3B5.tmp 43 PID 1620 wrote to memory of 876 1620 B432.tmp 44 PID 1620 wrote to memory of 876 1620 B432.tmp 44 PID 1620 wrote to memory of 876 1620 B432.tmp 44 PID 1620 wrote to memory of 876 1620 B432.tmp 44 PID 876 wrote to memory of 1900 876 B490.tmp 45 PID 876 wrote to memory of 1900 876 B490.tmp 45 PID 876 wrote to memory of 1900 876 B490.tmp 45 PID 876 wrote to memory of 1900 876 B490.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-09_50de947d20035e0d489eb0ef6f8b844e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\B348.tmp"C:\Users\Admin\AppData\Local\Temp\B348.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\B490.tmp"C:\Users\Admin\AppData\Local\Temp\B490.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\B654.tmp"C:\Users\Admin\AppData\Local\Temp\B654.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"C:\Users\Admin\AppData\Local\Temp\B6D1.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B73E.tmp"C:\Users\Admin\AppData\Local\Temp\B73E.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:828 -
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856 -
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:992 -
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"53⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"54⤵
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\C053.tmp"C:\Users\Admin\AppData\Local\Temp\C053.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"C:\Users\Admin\AppData\Local\Temp\C2B3.tmp"66⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"C:\Users\Admin\AppData\Local\Temp\C2F1.tmp"67⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"68⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"69⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"70⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"C:\Users\Admin\AppData\Local\Temp\C3EB.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\C429.tmp"C:\Users\Admin\AppData\Local\Temp\C429.tmp"72⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C468.tmp"C:\Users\Admin\AppData\Local\Temp\C468.tmp"73⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"C:\Users\Admin\AppData\Local\Temp\C4A6.tmp"74⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"75⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"76⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"77⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"78⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"79⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\C62C.tmp"C:\Users\Admin\AppData\Local\Temp\C62C.tmp"80⤵
- System Location Discovery: System Language Discovery
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\C66B.tmp"C:\Users\Admin\AppData\Local\Temp\C66B.tmp"81⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"C:\Users\Admin\AppData\Local\Temp\C6A9.tmp"82⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"83⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\C726.tmp"C:\Users\Admin\AppData\Local\Temp\C726.tmp"84⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"85⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"C:\Users\Admin\AppData\Local\Temp\C7A3.tmp"86⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"C:\Users\Admin\AppData\Local\Temp\C7E1.tmp"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\C81F.tmp"C:\Users\Admin\AppData\Local\Temp\C81F.tmp"88⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\C85E.tmp"C:\Users\Admin\AppData\Local\Temp\C85E.tmp"89⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"90⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\C919.tmp"C:\Users\Admin\AppData\Local\Temp\C919.tmp"92⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\C957.tmp"C:\Users\Admin\AppData\Local\Temp\C957.tmp"93⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\C996.tmp"C:\Users\Admin\AppData\Local\Temp\C996.tmp"94⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"C:\Users\Admin\AppData\Local\Temp\C9D4.tmp"95⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\CA13.tmp"C:\Users\Admin\AppData\Local\Temp\CA13.tmp"96⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\CA51.tmp"C:\Users\Admin\AppData\Local\Temp\CA51.tmp"97⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"C:\Users\Admin\AppData\Local\Temp\CA8F.tmp"98⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\CACE.tmp"C:\Users\Admin\AppData\Local\Temp\CACE.tmp"99⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"C:\Users\Admin\AppData\Local\Temp\CB0C.tmp"100⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"C:\Users\Admin\AppData\Local\Temp\CB4B.tmp"101⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"102⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"103⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"104⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"105⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"106⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"107⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"C:\Users\Admin\AppData\Local\Temp\CCFF.tmp"108⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"C:\Users\Admin\AppData\Local\Temp\CD3E.tmp"109⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"C:\Users\Admin\AppData\Local\Temp\CD7C.tmp"110⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"C:\Users\Admin\AppData\Local\Temp\CDBB.tmp"111⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"C:\Users\Admin\AppData\Local\Temp\CDF9.tmp"112⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\CE37.tmp"C:\Users\Admin\AppData\Local\Temp\CE37.tmp"113⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\CE76.tmp"C:\Users\Admin\AppData\Local\Temp\CE76.tmp"114⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"C:\Users\Admin\AppData\Local\Temp\CEB4.tmp"115⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"116⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"117⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"118⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"119⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"120⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"121⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-