Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe
-
Size
487KB
-
MD5
c7c968d6ae49c73cafb55ba9f03ac366
-
SHA1
36cef80e18e3286b71792cc9c84053a693d435f2
-
SHA256
7dd5e5d1c3d8a61b49bdd59464bf50d31fa365f4a342a8a3459c3205fac778df
-
SHA512
decb188af9c94d202cd3d45f4fae4ad351e5e1c4d0d415da0cb23efa93568ff835d0ad054b7d9b89cf7c47eba12cb9b4904e7ddda8b359ba1892deb5c5f52ba5
-
SSDEEP
6144:zorf3lPvovsgZnqG2C7mOTeiLxDxpNLxkZtQ2Boy6zfA9W3yCjke0uWavLX38FcI:yU5rCOTeiNr2KyCIq6uH8FnEKlEebZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2380 A583.tmp 1864 A5E0.tmp 2172 A65D.tmp 1300 A6BB.tmp 1304 A718.tmp 2816 A776.tmp 2764 A7D3.tmp 2912 A831.tmp 2184 A88F.tmp 2876 A8EC.tmp 2864 A93A.tmp 2656 A998.tmp 2320 A9E6.tmp 684 AA72.tmp 1580 AADF.tmp 1884 AB4D.tmp 2508 ABAA.tmp 2576 AC17.tmp 584 AC75.tmp 1612 ACF2.tmp 1248 AD4F.tmp 1284 ADBD.tmp 1624 AE0B.tmp 2976 AE68.tmp 2996 AEA7.tmp 2928 AEF5.tmp 2700 AF33.tmp 2372 AF71.tmp 2644 AFB0.tmp 1972 AFFE.tmp 2784 B04C.tmp 448 B08A.tmp 3040 B0C9.tmp 2148 B107.tmp 1036 B145.tmp 2040 B193.tmp 2452 B1D2.tmp 1772 B220.tmp 1188 B25E.tmp 1896 B2AC.tmp 924 B2EB.tmp 2208 B329.tmp 1672 B367.tmp 2228 B3A6.tmp 2104 B3E4.tmp 716 B432.tmp 2300 B471.tmp 1004 B4AF.tmp 1960 B4ED.tmp 2552 B53B.tmp 2564 B57A.tmp 2028 B5B8.tmp 1608 B635.tmp 2356 B673.tmp 3068 B6B2.tmp 1864 B6F0.tmp 2852 B72F.tmp 2492 B76D.tmp 2712 B7AB.tmp 2820 B7EA.tmp 2880 B828.tmp 3024 B867.tmp 2768 B8E3.tmp 2136 B922.tmp -
Loads dropped DLL 64 IoCs
pid Process 1732 2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe 2380 A583.tmp 1864 A5E0.tmp 2172 A65D.tmp 1300 A6BB.tmp 1304 A718.tmp 2816 A776.tmp 2764 A7D3.tmp 2912 A831.tmp 2184 A88F.tmp 2876 A8EC.tmp 2864 A93A.tmp 2656 A998.tmp 2320 A9E6.tmp 684 AA72.tmp 1580 AADF.tmp 1884 AB4D.tmp 2508 ABAA.tmp 2576 AC17.tmp 584 AC75.tmp 1612 ACF2.tmp 1248 AD4F.tmp 1284 ADBD.tmp 1624 AE0B.tmp 2976 AE68.tmp 2996 AEA7.tmp 2928 AEF5.tmp 2700 AF33.tmp 2372 AF71.tmp 2644 AFB0.tmp 1972 AFFE.tmp 2784 B04C.tmp 448 B08A.tmp 3040 B0C9.tmp 2148 B107.tmp 1036 B145.tmp 2040 B193.tmp 2452 B1D2.tmp 1772 B220.tmp 1188 B25E.tmp 1896 B2AC.tmp 924 B2EB.tmp 2208 B329.tmp 1672 B367.tmp 2228 B3A6.tmp 2104 B3E4.tmp 716 B432.tmp 2300 B471.tmp 1004 B4AF.tmp 1960 B4ED.tmp 2552 B53B.tmp 2564 B57A.tmp 1600 B5F7.tmp 1608 B635.tmp 2356 B673.tmp 3068 B6B2.tmp 1864 B6F0.tmp 2852 B72F.tmp 2492 B76D.tmp 2712 B7AB.tmp 2820 B7EA.tmp 2880 B828.tmp 3024 B867.tmp 2768 B8E3.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D920.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F844.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7916.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB6F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 894C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 21B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C948.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F161.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3F32.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B25E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 453A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8814.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1600.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 901F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD66.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5486.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8CF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1732 wrote to memory of 2380 1732 2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe 30 PID 1732 wrote to memory of 2380 1732 2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe 30 PID 1732 wrote to memory of 2380 1732 2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe 30 PID 1732 wrote to memory of 2380 1732 2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe 30 PID 2380 wrote to memory of 1864 2380 A583.tmp 31 PID 2380 wrote to memory of 1864 2380 A583.tmp 31 PID 2380 wrote to memory of 1864 2380 A583.tmp 31 PID 2380 wrote to memory of 1864 2380 A583.tmp 31 PID 1864 wrote to memory of 2172 1864 A5E0.tmp 32 PID 1864 wrote to memory of 2172 1864 A5E0.tmp 32 PID 1864 wrote to memory of 2172 1864 A5E0.tmp 32 PID 1864 wrote to memory of 2172 1864 A5E0.tmp 32 PID 2172 wrote to memory of 1300 2172 A65D.tmp 33 PID 2172 wrote to memory of 1300 2172 A65D.tmp 33 PID 2172 wrote to memory of 1300 2172 A65D.tmp 33 PID 2172 wrote to memory of 1300 2172 A65D.tmp 33 PID 1300 wrote to memory of 1304 1300 A6BB.tmp 34 PID 1300 wrote to memory of 1304 1300 A6BB.tmp 34 PID 1300 wrote to memory of 1304 1300 A6BB.tmp 34 PID 1300 wrote to memory of 1304 1300 A6BB.tmp 34 PID 1304 wrote to memory of 2816 1304 A718.tmp 35 PID 1304 wrote to memory of 2816 1304 A718.tmp 35 PID 1304 wrote to memory of 2816 1304 A718.tmp 35 PID 1304 wrote to memory of 2816 1304 A718.tmp 35 PID 2816 wrote to memory of 2764 2816 A776.tmp 36 PID 2816 wrote to memory of 2764 2816 A776.tmp 36 PID 2816 wrote to memory of 2764 2816 A776.tmp 36 PID 2816 wrote to memory of 2764 2816 A776.tmp 36 PID 2764 wrote to memory of 2912 2764 A7D3.tmp 37 PID 2764 wrote to memory of 2912 2764 A7D3.tmp 37 PID 2764 wrote to memory of 2912 2764 A7D3.tmp 37 PID 2764 wrote to memory of 2912 2764 A7D3.tmp 37 PID 2912 wrote to memory of 2184 2912 A831.tmp 38 PID 2912 wrote to memory of 2184 2912 A831.tmp 38 PID 2912 wrote to memory of 2184 2912 A831.tmp 38 PID 2912 wrote to memory of 2184 2912 A831.tmp 38 PID 2184 wrote to memory of 2876 2184 A88F.tmp 39 PID 2184 wrote to memory of 2876 2184 A88F.tmp 39 PID 2184 wrote to memory of 2876 2184 A88F.tmp 39 PID 2184 wrote to memory of 2876 2184 A88F.tmp 39 PID 2876 wrote to memory of 2864 2876 A8EC.tmp 40 PID 2876 wrote to memory of 2864 2876 A8EC.tmp 40 PID 2876 wrote to memory of 2864 2876 A8EC.tmp 40 PID 2876 wrote to memory of 2864 2876 A8EC.tmp 40 PID 2864 wrote to memory of 2656 2864 A93A.tmp 41 PID 2864 wrote to memory of 2656 2864 A93A.tmp 41 PID 2864 wrote to memory of 2656 2864 A93A.tmp 41 PID 2864 wrote to memory of 2656 2864 A93A.tmp 41 PID 2656 wrote to memory of 2320 2656 A998.tmp 42 PID 2656 wrote to memory of 2320 2656 A998.tmp 42 PID 2656 wrote to memory of 2320 2656 A998.tmp 42 PID 2656 wrote to memory of 2320 2656 A998.tmp 42 PID 2320 wrote to memory of 684 2320 A9E6.tmp 43 PID 2320 wrote to memory of 684 2320 A9E6.tmp 43 PID 2320 wrote to memory of 684 2320 A9E6.tmp 43 PID 2320 wrote to memory of 684 2320 A9E6.tmp 43 PID 684 wrote to memory of 1580 684 AA72.tmp 44 PID 684 wrote to memory of 1580 684 AA72.tmp 44 PID 684 wrote to memory of 1580 684 AA72.tmp 44 PID 684 wrote to memory of 1580 684 AA72.tmp 44 PID 1580 wrote to memory of 1884 1580 AADF.tmp 45 PID 1580 wrote to memory of 1884 1580 AADF.tmp 45 PID 1580 wrote to memory of 1884 1580 AADF.tmp 45 PID 1580 wrote to memory of 1884 1580 AADF.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_c7c968d6ae49c73cafb55ba9f03ac366_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\A718.tmp"C:\Users\Admin\AppData\Local\Temp\A718.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"C:\Users\Admin\AppData\Local\Temp\A7D3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\A88F.tmp"C:\Users\Admin\AppData\Local\Temp\A88F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\A93A.tmp"C:\Users\Admin\AppData\Local\Temp\A93A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\A998.tmp"C:\Users\Admin\AppData\Local\Temp\A998.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"C:\Users\Admin\AppData\Local\Temp\AB4D.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\AC75.tmp"C:\Users\Admin\AppData\Local\Temp\AC75.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"C:\Users\Admin\AppData\Local\Temp\ACF2.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"C:\Users\Admin\AppData\Local\Temp\ADBD.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"C:\Users\Admin\AppData\Local\Temp\AEF5.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\AF33.tmp"C:\Users\Admin\AppData\Local\Temp\AF33.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\AF71.tmp"C:\Users\Admin\AppData\Local\Temp\AF71.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"C:\Users\Admin\AppData\Local\Temp\AFB0.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\B193.tmp"C:\Users\Admin\AppData\Local\Temp\B193.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"C:\Users\Admin\AppData\Local\Temp\B1D2.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:716 -
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"53⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"54⤵
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\B76D.tmp"C:\Users\Admin\AppData\Local\Temp\B76D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"C:\Users\Admin\AppData\Local\Temp\B7AB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"C:\Users\Admin\AppData\Local\Temp\B7EA.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"66⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"67⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"C:\Users\Admin\AppData\Local\Temp\B9AE.tmp"68⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"69⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"70⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"72⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"73⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"74⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"75⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"76⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"77⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"78⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"79⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"80⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"81⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"82⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"84⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"85⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"86⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"87⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"88⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"89⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"90⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\BF78.tmp"C:\Users\Admin\AppData\Local\Temp\BF78.tmp"91⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"C:\Users\Admin\AppData\Local\Temp\BFB7.tmp"92⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"C:\Users\Admin\AppData\Local\Temp\BFF5.tmp"93⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"94⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"95⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"96⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"C:\Users\Admin\AppData\Local\Temp\C0EF.tmp"97⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"98⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"99⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"100⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\C207.tmp"C:\Users\Admin\AppData\Local\Temp\C207.tmp"101⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"102⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"103⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"104⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"105⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C34F.tmp"C:\Users\Admin\AppData\Local\Temp\C34F.tmp"106⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"107⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"C:\Users\Admin\AppData\Local\Temp\C3CC.tmp"108⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"109⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C449.tmp"C:\Users\Admin\AppData\Local\Temp\C449.tmp"110⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"111⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"C:\Users\Admin\AppData\Local\Temp\C4C5.tmp"112⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\C504.tmp"C:\Users\Admin\AppData\Local\Temp\C504.tmp"113⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"114⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"115⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"C:\Users\Admin\AppData\Local\Temp\C5BF.tmp"116⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"C:\Users\Admin\AppData\Local\Temp\C5FD.tmp"117⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"118⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"119⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"120⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"121⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"122⤵PID:1516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-