Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/09/2024, 06:43
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe
-
Size
520KB
-
MD5
74aa385f3eff1aa8721a9a48d2e65300
-
SHA1
e2dfcab83cf2f3ee42a78562401a1135712cfe06
-
SHA256
abacfe0bd5639b892cc2a4499a1b8eaeb4877ee01832ce2f747b54cf6a5aff1f
-
SHA512
e9e9fe4085dc815962ac59c1461e750412e683091ce6923c5689eb54bee29955f649a748d2794fb2eb145b2c0fd4cbba460a2cec991d5667059805bc7ad2bc5b
-
SSDEEP
12288:roRXOQjmOy7t7zLF6PjszGL59sCW6L9mmNZ:rogQ9yhGskV5mmN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2628 EF10.tmp 2748 EF7D.tmp 2784 F019.tmp 2192 F077.tmp 2548 F0E4.tmp 2688 F142.tmp 2524 F19F.tmp 2596 F1FD.tmp 2088 F26A.tmp 1044 F2C8.tmp 3008 F335.tmp 2376 F392.tmp 2200 F400.tmp 2820 F46D.tmp 2212 F4CA.tmp 2816 F538.tmp 2264 F5A5.tmp 2832 F602.tmp 2956 F660.tmp 1100 F6BE.tmp 320 F72B.tmp 2808 F798.tmp 696 F7F6.tmp 1872 F834.tmp 2208 F882.tmp 2248 F8C0.tmp 2908 F90E.tmp 2356 F95C.tmp 1096 F99B.tmp 2172 F9D9.tmp 2340 FA27.tmp 1336 FA75.tmp 2480 FAB4.tmp 316 FAF2.tmp 1800 FB30.tmp 1620 FB6F.tmp 1376 FBAD.tmp 756 FBEC.tmp 2620 FC2A.tmp 1348 FC68.tmp 876 FCA7.tmp 1940 FCF5.tmp 2044 FD33.tmp 2800 FD72.tmp 2120 FDB0.tmp 2456 FDFE.tmp 2428 FE3C.tmp 1692 FE7B.tmp 2888 FEB9.tmp 2076 FEF8.tmp 1028 FF36.tmp 1584 FF74.tmp 2228 FFB3.tmp 2664 FFF1.tmp 2632 30.tmp 2792 6E.tmp 2752 AC.tmp 2764 EB.tmp 2684 139.tmp 2224 177.tmp 2636 1C5.tmp 2520 204.tmp 2540 252.tmp 2564 290.tmp -
Loads dropped DLL 64 IoCs
pid Process 1964 2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe 2628 EF10.tmp 2748 EF7D.tmp 2784 F019.tmp 2192 F077.tmp 2548 F0E4.tmp 2688 F142.tmp 2524 F19F.tmp 2596 F1FD.tmp 2088 F26A.tmp 1044 F2C8.tmp 3008 F335.tmp 2376 F392.tmp 2200 F400.tmp 2820 F46D.tmp 2212 F4CA.tmp 2816 F538.tmp 2264 F5A5.tmp 2832 F602.tmp 2956 F660.tmp 1100 F6BE.tmp 320 F72B.tmp 2808 F798.tmp 696 F7F6.tmp 1872 F834.tmp 2208 F882.tmp 2248 F8C0.tmp 2908 F90E.tmp 2356 F95C.tmp 1096 F99B.tmp 2172 F9D9.tmp 2340 FA27.tmp 1336 FA75.tmp 2480 FAB4.tmp 316 FAF2.tmp 1800 FB30.tmp 1620 FB6F.tmp 1376 FBAD.tmp 756 FBEC.tmp 2620 FC2A.tmp 1348 FC68.tmp 876 FCA7.tmp 1940 FCF5.tmp 2044 FD33.tmp 2800 FD72.tmp 2120 FDB0.tmp 2456 FDFE.tmp 2428 FE3C.tmp 1692 FE7B.tmp 2888 FEB9.tmp 2076 FEF8.tmp 1028 FF36.tmp 1584 FF74.tmp 2228 FFB3.tmp 2664 FFF1.tmp 2632 30.tmp 2792 6E.tmp 2752 AC.tmp 2764 EB.tmp 2684 139.tmp 2224 177.tmp 2636 1C5.tmp 2520 204.tmp 2540 252.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 57F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7031.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DF57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F142.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9425.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C13D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39C6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5512.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6181.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D36.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5CB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6806.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DAA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5BD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ACF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 473D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2628 1964 2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe 30 PID 1964 wrote to memory of 2628 1964 2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe 30 PID 1964 wrote to memory of 2628 1964 2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe 30 PID 1964 wrote to memory of 2628 1964 2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe 30 PID 2628 wrote to memory of 2748 2628 EF10.tmp 31 PID 2628 wrote to memory of 2748 2628 EF10.tmp 31 PID 2628 wrote to memory of 2748 2628 EF10.tmp 31 PID 2628 wrote to memory of 2748 2628 EF10.tmp 31 PID 2748 wrote to memory of 2784 2748 EF7D.tmp 32 PID 2748 wrote to memory of 2784 2748 EF7D.tmp 32 PID 2748 wrote to memory of 2784 2748 EF7D.tmp 32 PID 2748 wrote to memory of 2784 2748 EF7D.tmp 32 PID 2784 wrote to memory of 2192 2784 F019.tmp 33 PID 2784 wrote to memory of 2192 2784 F019.tmp 33 PID 2784 wrote to memory of 2192 2784 F019.tmp 33 PID 2784 wrote to memory of 2192 2784 F019.tmp 33 PID 2192 wrote to memory of 2548 2192 F077.tmp 34 PID 2192 wrote to memory of 2548 2192 F077.tmp 34 PID 2192 wrote to memory of 2548 2192 F077.tmp 34 PID 2192 wrote to memory of 2548 2192 F077.tmp 34 PID 2548 wrote to memory of 2688 2548 F0E4.tmp 35 PID 2548 wrote to memory of 2688 2548 F0E4.tmp 35 PID 2548 wrote to memory of 2688 2548 F0E4.tmp 35 PID 2548 wrote to memory of 2688 2548 F0E4.tmp 35 PID 2688 wrote to memory of 2524 2688 F142.tmp 36 PID 2688 wrote to memory of 2524 2688 F142.tmp 36 PID 2688 wrote to memory of 2524 2688 F142.tmp 36 PID 2688 wrote to memory of 2524 2688 F142.tmp 36 PID 2524 wrote to memory of 2596 2524 F19F.tmp 37 PID 2524 wrote to memory of 2596 2524 F19F.tmp 37 PID 2524 wrote to memory of 2596 2524 F19F.tmp 37 PID 2524 wrote to memory of 2596 2524 F19F.tmp 37 PID 2596 wrote to memory of 2088 2596 F1FD.tmp 38 PID 2596 wrote to memory of 2088 2596 F1FD.tmp 38 PID 2596 wrote to memory of 2088 2596 F1FD.tmp 38 PID 2596 wrote to memory of 2088 2596 F1FD.tmp 38 PID 2088 wrote to memory of 1044 2088 F26A.tmp 39 PID 2088 wrote to memory of 1044 2088 F26A.tmp 39 PID 2088 wrote to memory of 1044 2088 F26A.tmp 39 PID 2088 wrote to memory of 1044 2088 F26A.tmp 39 PID 1044 wrote to memory of 3008 1044 F2C8.tmp 40 PID 1044 wrote to memory of 3008 1044 F2C8.tmp 40 PID 1044 wrote to memory of 3008 1044 F2C8.tmp 40 PID 1044 wrote to memory of 3008 1044 F2C8.tmp 40 PID 3008 wrote to memory of 2376 3008 F335.tmp 41 PID 3008 wrote to memory of 2376 3008 F335.tmp 41 PID 3008 wrote to memory of 2376 3008 F335.tmp 41 PID 3008 wrote to memory of 2376 3008 F335.tmp 41 PID 2376 wrote to memory of 2200 2376 F392.tmp 42 PID 2376 wrote to memory of 2200 2376 F392.tmp 42 PID 2376 wrote to memory of 2200 2376 F392.tmp 42 PID 2376 wrote to memory of 2200 2376 F392.tmp 42 PID 2200 wrote to memory of 2820 2200 F400.tmp 43 PID 2200 wrote to memory of 2820 2200 F400.tmp 43 PID 2200 wrote to memory of 2820 2200 F400.tmp 43 PID 2200 wrote to memory of 2820 2200 F400.tmp 43 PID 2820 wrote to memory of 2212 2820 F46D.tmp 44 PID 2820 wrote to memory of 2212 2820 F46D.tmp 44 PID 2820 wrote to memory of 2212 2820 F46D.tmp 44 PID 2820 wrote to memory of 2212 2820 F46D.tmp 44 PID 2212 wrote to memory of 2816 2212 F4CA.tmp 45 PID 2212 wrote to memory of 2816 2212 F4CA.tmp 45 PID 2212 wrote to memory of 2816 2212 F4CA.tmp 45 PID 2212 wrote to memory of 2816 2212 F4CA.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-12_74aa385f3eff1aa8721a9a48d2e65300_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\EF10.tmp"C:\Users\Admin\AppData\Local\Temp\EF10.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"C:\Users\Admin\AppData\Local\Temp\EF7D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\F019.tmp"C:\Users\Admin\AppData\Local\Temp\F019.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\F142.tmp"C:\Users\Admin\AppData\Local\Temp\F142.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\F19F.tmp"C:\Users\Admin\AppData\Local\Temp\F19F.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"C:\Users\Admin\AppData\Local\Temp\F2C8.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F392.tmp"C:\Users\Admin\AppData\Local\Temp\F392.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\F400.tmp"C:\Users\Admin\AppData\Local\Temp\F400.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\F538.tmp"C:\Users\Admin\AppData\Local\Temp\F538.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"C:\Users\Admin\AppData\Local\Temp\F6BE.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\F798.tmp"C:\Users\Admin\AppData\Local\Temp\F798.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"C:\Users\Admin\AppData\Local\Temp\F7F6.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:696 -
C:\Users\Admin\AppData\Local\Temp\F834.tmp"C:\Users\Admin\AppData\Local\Temp\F834.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\F882.tmp"C:\Users\Admin\AppData\Local\Temp\F882.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"C:\Users\Admin\AppData\Local\Temp\F8C0.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\F90E.tmp"C:\Users\Admin\AppData\Local\Temp\F90E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\FA27.tmp"C:\Users\Admin\AppData\Local\Temp\FA27.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\FA75.tmp"C:\Users\Admin\AppData\Local\Temp\FA75.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"C:\Users\Admin\AppData\Local\Temp\FAF2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316 -
C:\Users\Admin\AppData\Local\Temp\FB30.tmp"C:\Users\Admin\AppData\Local\Temp\FB30.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"C:\Users\Admin\AppData\Local\Temp\FB6F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"C:\Users\Admin\AppData\Local\Temp\FBAD.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"C:\Users\Admin\AppData\Local\Temp\FBEC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"C:\Users\Admin\AppData\Local\Temp\FC2A.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"C:\Users\Admin\AppData\Local\Temp\FCF5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\FD33.tmp"C:\Users\Admin\AppData\Local\Temp\FD33.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\FD72.tmp"C:\Users\Admin\AppData\Local\Temp\FD72.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"C:\Users\Admin\AppData\Local\Temp\FDFE.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"C:\Users\Admin\AppData\Local\Temp\FE3C.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"C:\Users\Admin\AppData\Local\Temp\FE7B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"C:\Users\Admin\AppData\Local\Temp\FEB9.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"C:\Users\Admin\AppData\Local\Temp\FEF8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\FF36.tmp"C:\Users\Admin\AppData\Local\Temp\FF36.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\FF74.tmp"C:\Users\Admin\AppData\Local\Temp\FF74.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"C:\Users\Admin\AppData\Local\Temp\FFB3.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"C:\Users\Admin\AppData\Local\Temp\FFF1.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\30.tmp"C:\Users\Admin\AppData\Local\Temp\30.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\6E.tmp"C:\Users\Admin\AppData\Local\Temp\6E.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\AC.tmp"C:\Users\Admin\AppData\Local\Temp\AC.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\139.tmp"C:\Users\Admin\AppData\Local\Temp\139.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\177.tmp"C:\Users\Admin\AppData\Local\Temp\177.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1C5.tmp"C:\Users\Admin\AppData\Local\Temp\1C5.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\204.tmp"C:\Users\Admin\AppData\Local\Temp\204.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"65⤵
- Executes dropped EXE
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"66⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\30D.tmp"C:\Users\Admin\AppData\Local\Temp\30D.tmp"67⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"68⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"69⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\3D8.tmp"C:\Users\Admin\AppData\Local\Temp\3D8.tmp"70⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\416.tmp"C:\Users\Admin\AppData\Local\Temp\416.tmp"71⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\454.tmp"C:\Users\Admin\AppData\Local\Temp\454.tmp"72⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\4A2.tmp"C:\Users\Admin\AppData\Local\Temp\4A2.tmp"73⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\4E1.tmp"C:\Users\Admin\AppData\Local\Temp\4E1.tmp"74⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\51F.tmp"C:\Users\Admin\AppData\Local\Temp\51F.tmp"75⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"76⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\59C.tmp"C:\Users\Admin\AppData\Local\Temp\59C.tmp"77⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5DA.tmp"C:\Users\Admin\AppData\Local\Temp\5DA.tmp"78⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\619.tmp"C:\Users\Admin\AppData\Local\Temp\619.tmp"79⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\657.tmp"C:\Users\Admin\AppData\Local\Temp\657.tmp"80⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\696.tmp"C:\Users\Admin\AppData\Local\Temp\696.tmp"81⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6D4.tmp"C:\Users\Admin\AppData\Local\Temp\6D4.tmp"82⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\712.tmp"C:\Users\Admin\AppData\Local\Temp\712.tmp"83⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"84⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\78F.tmp"C:\Users\Admin\AppData\Local\Temp\78F.tmp"85⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7DD.tmp"C:\Users\Admin\AppData\Local\Temp\7DD.tmp"86⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"87⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\85A.tmp"C:\Users\Admin\AppData\Local\Temp\85A.tmp"88⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\898.tmp"C:\Users\Admin\AppData\Local\Temp\898.tmp"89⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\8E6.tmp"C:\Users\Admin\AppData\Local\Temp\8E6.tmp"90⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\925.tmp"C:\Users\Admin\AppData\Local\Temp\925.tmp"91⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\963.tmp"C:\Users\Admin\AppData\Local\Temp\963.tmp"92⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\9F0.tmp"C:\Users\Admin\AppData\Local\Temp\9F0.tmp"94⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A2E.tmp"C:\Users\Admin\AppData\Local\Temp\A2E.tmp"95⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\A7C.tmp"C:\Users\Admin\AppData\Local\Temp\A7C.tmp"96⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\ACA.tmp"C:\Users\Admin\AppData\Local\Temp\ACA.tmp"97⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"98⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"99⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"100⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"101⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"102⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C50.tmp"C:\Users\Admin\AppData\Local\Temp\C50.tmp"103⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"104⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\CCD.tmp"C:\Users\Admin\AppData\Local\Temp\CCD.tmp"105⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\D0B.tmp"C:\Users\Admin\AppData\Local\Temp\D0B.tmp"106⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"107⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"108⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"109⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"110⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"111⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"112⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\EC0.tmp"C:\Users\Admin\AppData\Local\Temp\EC0.tmp"113⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"114⤵PID:276
-
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"115⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\F7B.tmp"C:\Users\Admin\AppData\Local\Temp\F7B.tmp"116⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"117⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"118⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"119⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"120⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\10C3.tmp"C:\Users\Admin\AppData\Local\Temp\10C3.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\10F2.tmp"C:\Users\Admin\AppData\Local\Temp\10F2.tmp"122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-