Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe
-
Size
536KB
-
MD5
a45b7405552883d221f8d2e9ab031cac
-
SHA1
0e6afc7946cd084f63a51c98cefb7296d938a045
-
SHA256
ed60b1ae454c2f20d59fc96ef04d8167dbc59531e4ca7b901278d1f916526c02
-
SHA512
81eb953d49f0bd3e65f8f72782d60588a42be2261d48c4b3df6ed4ce73cd02db75574f06b50077ce3494ac0f099249431b228a34ad28258ea4d7d96b1677a71e
-
SSDEEP
12288:wU5rCOTeiUyKIujoqsEp7P0G+5oX8MMQVoKt6gIZxVJ0ZT9:wUQOJUgujbsm7P0Ge7I9UgIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2680 2607.tmp 2760 2694.tmp 2668 274F.tmp 2820 27FA.tmp 2276 28B6.tmp 2536 2932.tmp 2616 29BF.tmp 2972 2A4B.tmp 1460 2B16.tmp 1416 2BB2.tmp 2892 2C3E.tmp 3020 2CFA.tmp 2436 2D96.tmp 1740 2E32.tmp 604 2EBE.tmp 2808 2F79.tmp 3044 3025.tmp 264 30C1.tmp 2036 315D.tmp 2160 3228.tmp 3016 32B4.tmp 2444 336F.tmp 1496 33EC.tmp 952 3459.tmp 1076 34B7.tmp 1948 3543.tmp 1916 3591.tmp 1996 360E.tmp 1984 368B.tmp 2300 3717.tmp 2500 3765.tmp 2144 37D2.tmp 1812 3811.tmp 2032 389D.tmp 1640 38DC.tmp 900 3978.tmp 1604 39B6.tmp 2648 39F4.tmp 2740 3A33.tmp 2764 3A71.tmp 3056 3AB0.tmp 2572 3AEE.tmp 2752 3B2C.tmp 2756 3B7A.tmp 2328 3BB9.tmp 2964 3C07.tmp 2288 3C45.tmp 1748 3C84.tmp 2352 3CC2.tmp 1276 3D10.tmp 2072 3D4E.tmp 1424 3D8D.tmp 1508 3DCB.tmp 2428 3E0A.tmp 1096 3E48.tmp 1068 3E86.tmp 1956 3EC5.tmp 604 3F13.tmp 1080 3F51.tmp 532 3F90.tmp 1756 3FCE.tmp 264 401C.tmp 2220 405A.tmp 1860 40A8.tmp -
Loads dropped DLL 64 IoCs
pid Process 2488 2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe 2680 2607.tmp 2760 2694.tmp 2668 274F.tmp 2820 27FA.tmp 2276 28B6.tmp 2536 2932.tmp 2616 29BF.tmp 2972 2A4B.tmp 1460 2B16.tmp 1416 2BB2.tmp 2892 2C3E.tmp 3020 2CFA.tmp 2436 2D96.tmp 1740 2E32.tmp 604 2EBE.tmp 2808 2F79.tmp 3044 3025.tmp 264 30C1.tmp 2036 315D.tmp 2160 3228.tmp 3016 32B4.tmp 2444 336F.tmp 1496 33EC.tmp 952 3459.tmp 1076 34B7.tmp 1948 3543.tmp 1916 3591.tmp 1996 360E.tmp 1984 368B.tmp 2300 3717.tmp 2500 3765.tmp 2144 37D2.tmp 1812 3811.tmp 2032 389D.tmp 1640 38DC.tmp 900 3978.tmp 1604 39B6.tmp 2648 39F4.tmp 2740 3A33.tmp 2764 3A71.tmp 3056 3AB0.tmp 2572 3AEE.tmp 2752 3B2C.tmp 2756 3B7A.tmp 2328 3BB9.tmp 2964 3C07.tmp 2288 3C45.tmp 1748 3C84.tmp 2352 3CC2.tmp 1276 3D10.tmp 2072 3D4E.tmp 1424 3D8D.tmp 1508 3DCB.tmp 2428 3E0A.tmp 1096 3E48.tmp 1068 3E86.tmp 1956 3EC5.tmp 604 3F13.tmp 1080 3F51.tmp 532 3F90.tmp 1756 3FCE.tmp 264 401C.tmp 2220 405A.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 65D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1555.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A785.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D9FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 739A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8F3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB63.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D49E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2913.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 559F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCE7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C487.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A747.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AB6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB71.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6623.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C38D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F547.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A8F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2694.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E85C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD0F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2680 2488 2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe 30 PID 2488 wrote to memory of 2680 2488 2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe 30 PID 2488 wrote to memory of 2680 2488 2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe 30 PID 2488 wrote to memory of 2680 2488 2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe 30 PID 2680 wrote to memory of 2760 2680 2607.tmp 31 PID 2680 wrote to memory of 2760 2680 2607.tmp 31 PID 2680 wrote to memory of 2760 2680 2607.tmp 31 PID 2680 wrote to memory of 2760 2680 2607.tmp 31 PID 2760 wrote to memory of 2668 2760 2694.tmp 32 PID 2760 wrote to memory of 2668 2760 2694.tmp 32 PID 2760 wrote to memory of 2668 2760 2694.tmp 32 PID 2760 wrote to memory of 2668 2760 2694.tmp 32 PID 2668 wrote to memory of 2820 2668 274F.tmp 33 PID 2668 wrote to memory of 2820 2668 274F.tmp 33 PID 2668 wrote to memory of 2820 2668 274F.tmp 33 PID 2668 wrote to memory of 2820 2668 274F.tmp 33 PID 2820 wrote to memory of 2276 2820 27FA.tmp 34 PID 2820 wrote to memory of 2276 2820 27FA.tmp 34 PID 2820 wrote to memory of 2276 2820 27FA.tmp 34 PID 2820 wrote to memory of 2276 2820 27FA.tmp 34 PID 2276 wrote to memory of 2536 2276 28B6.tmp 35 PID 2276 wrote to memory of 2536 2276 28B6.tmp 35 PID 2276 wrote to memory of 2536 2276 28B6.tmp 35 PID 2276 wrote to memory of 2536 2276 28B6.tmp 35 PID 2536 wrote to memory of 2616 2536 2932.tmp 36 PID 2536 wrote to memory of 2616 2536 2932.tmp 36 PID 2536 wrote to memory of 2616 2536 2932.tmp 36 PID 2536 wrote to memory of 2616 2536 2932.tmp 36 PID 2616 wrote to memory of 2972 2616 29BF.tmp 37 PID 2616 wrote to memory of 2972 2616 29BF.tmp 37 PID 2616 wrote to memory of 2972 2616 29BF.tmp 37 PID 2616 wrote to memory of 2972 2616 29BF.tmp 37 PID 2972 wrote to memory of 1460 2972 2A4B.tmp 38 PID 2972 wrote to memory of 1460 2972 2A4B.tmp 38 PID 2972 wrote to memory of 1460 2972 2A4B.tmp 38 PID 2972 wrote to memory of 1460 2972 2A4B.tmp 38 PID 1460 wrote to memory of 1416 1460 2B16.tmp 39 PID 1460 wrote to memory of 1416 1460 2B16.tmp 39 PID 1460 wrote to memory of 1416 1460 2B16.tmp 39 PID 1460 wrote to memory of 1416 1460 2B16.tmp 39 PID 1416 wrote to memory of 2892 1416 2BB2.tmp 40 PID 1416 wrote to memory of 2892 1416 2BB2.tmp 40 PID 1416 wrote to memory of 2892 1416 2BB2.tmp 40 PID 1416 wrote to memory of 2892 1416 2BB2.tmp 40 PID 2892 wrote to memory of 3020 2892 2C3E.tmp 41 PID 2892 wrote to memory of 3020 2892 2C3E.tmp 41 PID 2892 wrote to memory of 3020 2892 2C3E.tmp 41 PID 2892 wrote to memory of 3020 2892 2C3E.tmp 41 PID 3020 wrote to memory of 2436 3020 2CFA.tmp 42 PID 3020 wrote to memory of 2436 3020 2CFA.tmp 42 PID 3020 wrote to memory of 2436 3020 2CFA.tmp 42 PID 3020 wrote to memory of 2436 3020 2CFA.tmp 42 PID 2436 wrote to memory of 1740 2436 2D96.tmp 43 PID 2436 wrote to memory of 1740 2436 2D96.tmp 43 PID 2436 wrote to memory of 1740 2436 2D96.tmp 43 PID 2436 wrote to memory of 1740 2436 2D96.tmp 43 PID 1740 wrote to memory of 604 1740 2E32.tmp 44 PID 1740 wrote to memory of 604 1740 2E32.tmp 44 PID 1740 wrote to memory of 604 1740 2E32.tmp 44 PID 1740 wrote to memory of 604 1740 2E32.tmp 44 PID 604 wrote to memory of 2808 604 2EBE.tmp 45 PID 604 wrote to memory of 2808 604 2EBE.tmp 45 PID 604 wrote to memory of 2808 604 2EBE.tmp 45 PID 604 wrote to memory of 2808 604 2EBE.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-13_a45b7405552883d221f8d2e9ab031cac_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2694.tmp"C:\Users\Admin\AppData\Local\Temp\2694.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"C:\Users\Admin\AppData\Local\Temp\2BB2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"C:\Users\Admin\AppData\Local\Temp\2C3E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"C:\Users\Admin\AppData\Local\Temp\2CFA.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\2E32.tmp"C:\Users\Admin\AppData\Local\Temp\2E32.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"C:\Users\Admin\AppData\Local\Temp\2EBE.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:604 -
C:\Users\Admin\AppData\Local\Temp\2F79.tmp"C:\Users\Admin\AppData\Local\Temp\2F79.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\3025.tmp"C:\Users\Admin\AppData\Local\Temp\3025.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\30C1.tmp"C:\Users\Admin\AppData\Local\Temp\30C1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\33EC.tmp"C:\Users\Admin\AppData\Local\Temp\33EC.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:952 -
C:\Users\Admin\AppData\Local\Temp\34B7.tmp"C:\Users\Admin\AppData\Local\Temp\34B7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\3543.tmp"C:\Users\Admin\AppData\Local\Temp\3543.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3591.tmp"C:\Users\Admin\AppData\Local\Temp\3591.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\360E.tmp"C:\Users\Admin\AppData\Local\Temp\360E.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\368B.tmp"C:\Users\Admin\AppData\Local\Temp\368B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\3717.tmp"C:\Users\Admin\AppData\Local\Temp\3717.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\3765.tmp"C:\Users\Admin\AppData\Local\Temp\3765.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\37D2.tmp"C:\Users\Admin\AppData\Local\Temp\37D2.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\38DC.tmp"C:\Users\Admin\AppData\Local\Temp\38DC.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\3978.tmp"C:\Users\Admin\AppData\Local\Temp\3978.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\39B6.tmp"C:\Users\Admin\AppData\Local\Temp\39B6.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\39F4.tmp"C:\Users\Admin\AppData\Local\Temp\39F4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\3A33.tmp"C:\Users\Admin\AppData\Local\Temp\3A33.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3A71.tmp"C:\Users\Admin\AppData\Local\Temp\3A71.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"C:\Users\Admin\AppData\Local\Temp\3AEE.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"C:\Users\Admin\AppData\Local\Temp\3B2C.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"C:\Users\Admin\AppData\Local\Temp\3BB9.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3D10.tmp"C:\Users\Admin\AppData\Local\Temp\3D10.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:604 -
C:\Users\Admin\AppData\Local\Temp\3F51.tmp"C:\Users\Admin\AppData\Local\Temp\3F51.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\3F90.tmp"C:\Users\Admin\AppData\Local\Temp\3F90.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532 -
C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"C:\Users\Admin\AppData\Local\Temp\3FCE.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\401C.tmp"C:\Users\Admin\AppData\Local\Temp\401C.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:264 -
C:\Users\Admin\AppData\Local\Temp\405A.tmp"C:\Users\Admin\AppData\Local\Temp\405A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"65⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\40E7.tmp"C:\Users\Admin\AppData\Local\Temp\40E7.tmp"66⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4125.tmp"C:\Users\Admin\AppData\Local\Temp\4125.tmp"67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\4164.tmp"C:\Users\Admin\AppData\Local\Temp\4164.tmp"68⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"69⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"70⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"71⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"72⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"73⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"74⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"75⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\4366.tmp"C:\Users\Admin\AppData\Local\Temp\4366.tmp"76⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"77⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\43F3.tmp"C:\Users\Admin\AppData\Local\Temp\43F3.tmp"78⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\4431.tmp"C:\Users\Admin\AppData\Local\Temp\4431.tmp"79⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"80⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"81⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\44EC.tmp"C:\Users\Admin\AppData\Local\Temp\44EC.tmp"82⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\452B.tmp"C:\Users\Admin\AppData\Local\Temp\452B.tmp"83⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\4569.tmp"C:\Users\Admin\AppData\Local\Temp\4569.tmp"84⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\45A8.tmp"C:\Users\Admin\AppData\Local\Temp\45A8.tmp"85⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"86⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\4624.tmp"C:\Users\Admin\AppData\Local\Temp\4624.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\4663.tmp"C:\Users\Admin\AppData\Local\Temp\4663.tmp"88⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\46A1.tmp"C:\Users\Admin\AppData\Local\Temp\46A1.tmp"89⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\46E0.tmp"C:\Users\Admin\AppData\Local\Temp\46E0.tmp"90⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\471E.tmp"C:\Users\Admin\AppData\Local\Temp\471E.tmp"91⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\475C.tmp"C:\Users\Admin\AppData\Local\Temp\475C.tmp"92⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\479B.tmp"C:\Users\Admin\AppData\Local\Temp\479B.tmp"93⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\47D9.tmp"C:\Users\Admin\AppData\Local\Temp\47D9.tmp"94⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\4827.tmp"C:\Users\Admin\AppData\Local\Temp\4827.tmp"95⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"96⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"97⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\48F2.tmp"C:\Users\Admin\AppData\Local\Temp\48F2.tmp"98⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\4940.tmp"C:\Users\Admin\AppData\Local\Temp\4940.tmp"99⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\497E.tmp"C:\Users\Admin\AppData\Local\Temp\497E.tmp"100⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\49BD.tmp"C:\Users\Admin\AppData\Local\Temp\49BD.tmp"101⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\49FB.tmp"C:\Users\Admin\AppData\Local\Temp\49FB.tmp"102⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"103⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\4A78.tmp"C:\Users\Admin\AppData\Local\Temp\4A78.tmp"104⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"105⤵
- System Location Discovery: System Language Discovery
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"C:\Users\Admin\AppData\Local\Temp\4AF5.tmp"106⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\4B33.tmp"C:\Users\Admin\AppData\Local\Temp\4B33.tmp"107⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\4B72.tmp"C:\Users\Admin\AppData\Local\Temp\4B72.tmp"108⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"C:\Users\Admin\AppData\Local\Temp\4BB0.tmp"109⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"C:\Users\Admin\AppData\Local\Temp\4BEE.tmp"110⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"C:\Users\Admin\AppData\Local\Temp\4C1D.tmp"111⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"C:\Users\Admin\AppData\Local\Temp\4C6B.tmp"112⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"C:\Users\Admin\AppData\Local\Temp\4CAA.tmp"113⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"C:\Users\Admin\AppData\Local\Temp\4CE8.tmp"114⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"115⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4D65.tmp"C:\Users\Admin\AppData\Local\Temp\4D65.tmp"116⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"117⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"C:\Users\Admin\AppData\Local\Temp\4DE2.tmp"118⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\4E30.tmp"C:\Users\Admin\AppData\Local\Temp\4E30.tmp"119⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"120⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"121⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"122⤵PID:2856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-