Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/09/2024, 06:51
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe
-
Size
541KB
-
MD5
8ed49b72a1a05bb6ded797fcb7e8de5a
-
SHA1
32f7f6fdcad10fd30218019a72185808484c3927
-
SHA256
334711438b39215ed23d7a2214b2d4bd508641ee1ad207c51c671d3bd1610d95
-
SHA512
d5226c2613e0ffdb18656854596278bf490fdf2b2a19bae58265a7081637d054a2f5a0b9577545e7f31e0525a840a1c2eb2ccb53aee4555cc93c68066f41b91a
-
SSDEEP
12288:UU5rCOTeifAzULPNWvBh0DxiY7zpopYDrZa73ctO:UUQOJfAA7Uex7zpMYDrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2944 4808.tmp 1452 4866.tmp 2716 48E2.tmp 1988 4950.tmp 2656 49CC.tmp 2424 4A3A.tmp 2596 4AB6.tmp 2456 4B43.tmp 2524 4BC0.tmp 2936 4C3C.tmp 2016 4CB9.tmp 332 4D36.tmp 1404 4DA3.tmp 2784 4E01.tmp 2892 4E6E.tmp 2904 4ECC.tmp 2216 4F29.tmp 2020 4F87.tmp 1992 4FE4.tmp 1856 5042.tmp 2528 50A0.tmp 2776 510D.tmp 1924 516A.tmp 396 51B8.tmp 236 51F7.tmp 2156 5245.tmp 2072 5283.tmp 2312 52C2.tmp 1716 5310.tmp 2844 535E.tmp 2436 539C.tmp 1664 53EA.tmp 1928 5438.tmp 1468 5486.tmp 1004 54D4.tmp 2172 5522.tmp 852 5570.tmp 2300 55AE.tmp 2792 55ED.tmp 2320 562B.tmp 980 566A.tmp 1204 56B8.tmp 1188 56F6.tmp 1072 5744.tmp 932 5782.tmp 2816 57D0.tmp 860 580F.tmp 2396 584D.tmp 1948 588C.tmp 1832 58CA.tmp 2252 5918.tmp 1888 5956.tmp 892 5995.tmp 2008 59E3.tmp 2640 5A31.tmp 1536 5A6F.tmp 1504 5ABD.tmp 3040 5AFC.tmp 2688 5B59.tmp 2848 5BA7.tmp 2584 5BE6.tmp 2092 5C34.tmp 2564 5C82.tmp 2660 5CD0.tmp -
Loads dropped DLL 64 IoCs
pid Process 2080 2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe 2944 4808.tmp 1452 4866.tmp 2716 48E2.tmp 1988 4950.tmp 2656 49CC.tmp 2424 4A3A.tmp 2596 4AB6.tmp 2456 4B43.tmp 2524 4BC0.tmp 2936 4C3C.tmp 2016 4CB9.tmp 332 4D36.tmp 1404 4DA3.tmp 2784 4E01.tmp 2892 4E6E.tmp 2904 4ECC.tmp 2216 4F29.tmp 2020 4F87.tmp 1992 4FE4.tmp 1856 5042.tmp 2528 50A0.tmp 2776 510D.tmp 1924 516A.tmp 396 51B8.tmp 236 51F7.tmp 2156 5245.tmp 2072 5283.tmp 2312 52C2.tmp 1716 5310.tmp 2844 535E.tmp 2436 539C.tmp 1664 53EA.tmp 1928 5438.tmp 1468 5486.tmp 1004 54D4.tmp 2172 5522.tmp 852 5570.tmp 2300 55AE.tmp 2792 55ED.tmp 2320 562B.tmp 980 566A.tmp 1204 56B8.tmp 1188 56F6.tmp 1072 5744.tmp 932 5782.tmp 2816 57D0.tmp 860 580F.tmp 2396 584D.tmp 1948 588C.tmp 1832 58CA.tmp 2252 5918.tmp 1888 5956.tmp 892 5995.tmp 2008 59E3.tmp 2640 5A31.tmp 1536 5A6F.tmp 1504 5ABD.tmp 3040 5AFC.tmp 2688 5B59.tmp 2848 5BA7.tmp 2584 5BE6.tmp 2092 5C34.tmp 2564 5C82.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9888.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A39F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D910.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4F9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 407A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B84.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 824A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 35D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F096.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9138.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A19C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 496F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D6A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E56F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4106.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCD1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F7E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F97C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B5E7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2944 2080 2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe 28 PID 2080 wrote to memory of 2944 2080 2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe 28 PID 2080 wrote to memory of 2944 2080 2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe 28 PID 2080 wrote to memory of 2944 2080 2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe 28 PID 2944 wrote to memory of 1452 2944 4808.tmp 29 PID 2944 wrote to memory of 1452 2944 4808.tmp 29 PID 2944 wrote to memory of 1452 2944 4808.tmp 29 PID 2944 wrote to memory of 1452 2944 4808.tmp 29 PID 1452 wrote to memory of 2716 1452 4866.tmp 30 PID 1452 wrote to memory of 2716 1452 4866.tmp 30 PID 1452 wrote to memory of 2716 1452 4866.tmp 30 PID 1452 wrote to memory of 2716 1452 4866.tmp 30 PID 2716 wrote to memory of 1988 2716 48E2.tmp 31 PID 2716 wrote to memory of 1988 2716 48E2.tmp 31 PID 2716 wrote to memory of 1988 2716 48E2.tmp 31 PID 2716 wrote to memory of 1988 2716 48E2.tmp 31 PID 1988 wrote to memory of 2656 1988 4950.tmp 32 PID 1988 wrote to memory of 2656 1988 4950.tmp 32 PID 1988 wrote to memory of 2656 1988 4950.tmp 32 PID 1988 wrote to memory of 2656 1988 4950.tmp 32 PID 2656 wrote to memory of 2424 2656 49CC.tmp 33 PID 2656 wrote to memory of 2424 2656 49CC.tmp 33 PID 2656 wrote to memory of 2424 2656 49CC.tmp 33 PID 2656 wrote to memory of 2424 2656 49CC.tmp 33 PID 2424 wrote to memory of 2596 2424 4A3A.tmp 34 PID 2424 wrote to memory of 2596 2424 4A3A.tmp 34 PID 2424 wrote to memory of 2596 2424 4A3A.tmp 34 PID 2424 wrote to memory of 2596 2424 4A3A.tmp 34 PID 2596 wrote to memory of 2456 2596 4AB6.tmp 35 PID 2596 wrote to memory of 2456 2596 4AB6.tmp 35 PID 2596 wrote to memory of 2456 2596 4AB6.tmp 35 PID 2596 wrote to memory of 2456 2596 4AB6.tmp 35 PID 2456 wrote to memory of 2524 2456 4B43.tmp 36 PID 2456 wrote to memory of 2524 2456 4B43.tmp 36 PID 2456 wrote to memory of 2524 2456 4B43.tmp 36 PID 2456 wrote to memory of 2524 2456 4B43.tmp 36 PID 2524 wrote to memory of 2936 2524 4BC0.tmp 37 PID 2524 wrote to memory of 2936 2524 4BC0.tmp 37 PID 2524 wrote to memory of 2936 2524 4BC0.tmp 37 PID 2524 wrote to memory of 2936 2524 4BC0.tmp 37 PID 2936 wrote to memory of 2016 2936 4C3C.tmp 38 PID 2936 wrote to memory of 2016 2936 4C3C.tmp 38 PID 2936 wrote to memory of 2016 2936 4C3C.tmp 38 PID 2936 wrote to memory of 2016 2936 4C3C.tmp 38 PID 2016 wrote to memory of 332 2016 4CB9.tmp 39 PID 2016 wrote to memory of 332 2016 4CB9.tmp 39 PID 2016 wrote to memory of 332 2016 4CB9.tmp 39 PID 2016 wrote to memory of 332 2016 4CB9.tmp 39 PID 332 wrote to memory of 1404 332 4D36.tmp 40 PID 332 wrote to memory of 1404 332 4D36.tmp 40 PID 332 wrote to memory of 1404 332 4D36.tmp 40 PID 332 wrote to memory of 1404 332 4D36.tmp 40 PID 1404 wrote to memory of 2784 1404 4DA3.tmp 41 PID 1404 wrote to memory of 2784 1404 4DA3.tmp 41 PID 1404 wrote to memory of 2784 1404 4DA3.tmp 41 PID 1404 wrote to memory of 2784 1404 4DA3.tmp 41 PID 2784 wrote to memory of 2892 2784 4E01.tmp 42 PID 2784 wrote to memory of 2892 2784 4E01.tmp 42 PID 2784 wrote to memory of 2892 2784 4E01.tmp 42 PID 2784 wrote to memory of 2892 2784 4E01.tmp 42 PID 2892 wrote to memory of 2904 2892 4E6E.tmp 43 PID 2892 wrote to memory of 2904 2892 4E6E.tmp 43 PID 2892 wrote to memory of 2904 2892 4E6E.tmp 43 PID 2892 wrote to memory of 2904 2892 4E6E.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-15_8ed49b72a1a05bb6ded797fcb7e8de5a_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\4808.tmp"C:\Users\Admin\AppData\Local\Temp\4808.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4866.tmp"C:\Users\Admin\AppData\Local\Temp\4866.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\48E2.tmp"C:\Users\Admin\AppData\Local\Temp\48E2.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4950.tmp"C:\Users\Admin\AppData\Local\Temp\4950.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\49CC.tmp"C:\Users\Admin\AppData\Local\Temp\49CC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"C:\Users\Admin\AppData\Local\Temp\4A3A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"C:\Users\Admin\AppData\Local\Temp\4AB6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\4B43.tmp"C:\Users\Admin\AppData\Local\Temp\4B43.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"C:\Users\Admin\AppData\Local\Temp\4BC0.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"C:\Users\Admin\AppData\Local\Temp\4C3C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"C:\Users\Admin\AppData\Local\Temp\4CB9.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4D36.tmp"C:\Users\Admin\AppData\Local\Temp\4D36.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\5042.tmp"C:\Users\Admin\AppData\Local\Temp\5042.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\510D.tmp"C:\Users\Admin\AppData\Local\Temp\510D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\516A.tmp"C:\Users\Admin\AppData\Local\Temp\516A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\51B8.tmp"C:\Users\Admin\AppData\Local\Temp\51B8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\51F7.tmp"C:\Users\Admin\AppData\Local\Temp\51F7.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:236 -
C:\Users\Admin\AppData\Local\Temp\5245.tmp"C:\Users\Admin\AppData\Local\Temp\5245.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\5283.tmp"C:\Users\Admin\AppData\Local\Temp\5283.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\52C2.tmp"C:\Users\Admin\AppData\Local\Temp\52C2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\535E.tmp"C:\Users\Admin\AppData\Local\Temp\535E.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\539C.tmp"C:\Users\Admin\AppData\Local\Temp\539C.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\53EA.tmp"C:\Users\Admin\AppData\Local\Temp\53EA.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\5438.tmp"C:\Users\Admin\AppData\Local\Temp\5438.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5486.tmp"C:\Users\Admin\AppData\Local\Temp\5486.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\54D4.tmp"C:\Users\Admin\AppData\Local\Temp\54D4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\5522.tmp"C:\Users\Admin\AppData\Local\Temp\5522.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\5570.tmp"C:\Users\Admin\AppData\Local\Temp\5570.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\55AE.tmp"C:\Users\Admin\AppData\Local\Temp\55AE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\55ED.tmp"C:\Users\Admin\AppData\Local\Temp\55ED.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\566A.tmp"C:\Users\Admin\AppData\Local\Temp\566A.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:980 -
C:\Users\Admin\AppData\Local\Temp\56B8.tmp"C:\Users\Admin\AppData\Local\Temp\56B8.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\56F6.tmp"C:\Users\Admin\AppData\Local\Temp\56F6.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\5744.tmp"C:\Users\Admin\AppData\Local\Temp\5744.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5782.tmp"C:\Users\Admin\AppData\Local\Temp\5782.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:932 -
C:\Users\Admin\AppData\Local\Temp\57D0.tmp"C:\Users\Admin\AppData\Local\Temp\57D0.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\580F.tmp"C:\Users\Admin\AppData\Local\Temp\580F.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\588C.tmp"C:\Users\Admin\AppData\Local\Temp\588C.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5918.tmp"C:\Users\Admin\AppData\Local\Temp\5918.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\5995.tmp"C:\Users\Admin\AppData\Local\Temp\5995.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\59E3.tmp"C:\Users\Admin\AppData\Local\Temp\59E3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5A31.tmp"C:\Users\Admin\AppData\Local\Temp\5A31.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"C:\Users\Admin\AppData\Local\Temp\5ABD.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"C:\Users\Admin\AppData\Local\Temp\5AFC.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\5B59.tmp"C:\Users\Admin\AppData\Local\Temp\5B59.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"C:\Users\Admin\AppData\Local\Temp\5BA7.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"C:\Users\Admin\AppData\Local\Temp\5BE6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5C34.tmp"C:\Users\Admin\AppData\Local\Temp\5C34.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\5C82.tmp"C:\Users\Admin\AppData\Local\Temp\5C82.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"C:\Users\Admin\AppData\Local\Temp\5CD0.tmp"65⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"C:\Users\Admin\AppData\Local\Temp\5D1E.tmp"66⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"C:\Users\Admin\AppData\Local\Temp\5D6C.tmp"67⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"C:\Users\Admin\AppData\Local\Temp\5DAA.tmp"68⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"C:\Users\Admin\AppData\Local\Temp\5DE8.tmp"69⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\5E36.tmp"C:\Users\Admin\AppData\Local\Temp\5E36.tmp"70⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\5E75.tmp"C:\Users\Admin\AppData\Local\Temp\5E75.tmp"71⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"C:\Users\Admin\AppData\Local\Temp\5EB3.tmp"72⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"C:\Users\Admin\AppData\Local\Temp\5EF2.tmp"73⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5F40.tmp"C:\Users\Admin\AppData\Local\Temp\5F40.tmp"74⤵PID:608
-
C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"C:\Users\Admin\AppData\Local\Temp\5F8E.tmp"75⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"C:\Users\Admin\AppData\Local\Temp\5FDC.tmp"76⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\602A.tmp"C:\Users\Admin\AppData\Local\Temp\602A.tmp"77⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6078.tmp"C:\Users\Admin\AppData\Local\Temp\6078.tmp"78⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"79⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\60F4.tmp"C:\Users\Admin\AppData\Local\Temp\60F4.tmp"80⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6142.tmp"C:\Users\Admin\AppData\Local\Temp\6142.tmp"81⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6181.tmp"C:\Users\Admin\AppData\Local\Temp\6181.tmp"82⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"83⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\61FE.tmp"C:\Users\Admin\AppData\Local\Temp\61FE.tmp"84⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\623C.tmp"C:\Users\Admin\AppData\Local\Temp\623C.tmp"85⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\627A.tmp"C:\Users\Admin\AppData\Local\Temp\627A.tmp"86⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"87⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\62F7.tmp"C:\Users\Admin\AppData\Local\Temp\62F7.tmp"88⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"89⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\6384.tmp"C:\Users\Admin\AppData\Local\Temp\6384.tmp"90⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\63C2.tmp"C:\Users\Admin\AppData\Local\Temp\63C2.tmp"91⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\6410.tmp"C:\Users\Admin\AppData\Local\Temp\6410.tmp"92⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\644F.tmp"C:\Users\Admin\AppData\Local\Temp\644F.tmp"93⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\648D.tmp"C:\Users\Admin\AppData\Local\Temp\648D.tmp"94⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\64CB.tmp"C:\Users\Admin\AppData\Local\Temp\64CB.tmp"95⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"96⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6558.tmp"C:\Users\Admin\AppData\Local\Temp\6558.tmp"97⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\6596.tmp"C:\Users\Admin\AppData\Local\Temp\6596.tmp"98⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\65E4.tmp"C:\Users\Admin\AppData\Local\Temp\65E4.tmp"99⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6623.tmp"C:\Users\Admin\AppData\Local\Temp\6623.tmp"100⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\6661.tmp"C:\Users\Admin\AppData\Local\Temp\6661.tmp"101⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\669F.tmp"C:\Users\Admin\AppData\Local\Temp\669F.tmp"102⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\66DE.tmp"C:\Users\Admin\AppData\Local\Temp\66DE.tmp"103⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\671C.tmp"C:\Users\Admin\AppData\Local\Temp\671C.tmp"104⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\676A.tmp"C:\Users\Admin\AppData\Local\Temp\676A.tmp"105⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\67A9.tmp"C:\Users\Admin\AppData\Local\Temp\67A9.tmp"106⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\67E7.tmp"C:\Users\Admin\AppData\Local\Temp\67E7.tmp"107⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6825.tmp"C:\Users\Admin\AppData\Local\Temp\6825.tmp"108⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\6864.tmp"C:\Users\Admin\AppData\Local\Temp\6864.tmp"109⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\68A2.tmp"C:\Users\Admin\AppData\Local\Temp\68A2.tmp"110⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\68E1.tmp"C:\Users\Admin\AppData\Local\Temp\68E1.tmp"111⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\691F.tmp"C:\Users\Admin\AppData\Local\Temp\691F.tmp"112⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\695D.tmp"C:\Users\Admin\AppData\Local\Temp\695D.tmp"113⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\699C.tmp"C:\Users\Admin\AppData\Local\Temp\699C.tmp"114⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\69DA.tmp"C:\Users\Admin\AppData\Local\Temp\69DA.tmp"115⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\6A19.tmp"C:\Users\Admin\AppData\Local\Temp\6A19.tmp"116⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\6A57.tmp"C:\Users\Admin\AppData\Local\Temp\6A57.tmp"117⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\6A95.tmp"C:\Users\Admin\AppData\Local\Temp\6A95.tmp"118⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"C:\Users\Admin\AppData\Local\Temp\6AD4.tmp"119⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6B12.tmp"C:\Users\Admin\AppData\Local\Temp\6B12.tmp"120⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6B60.tmp"C:\Users\Admin\AppData\Local\Temp\6B60.tmp"121⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"C:\Users\Admin\AppData\Local\Temp\6B9F.tmp"122⤵PID:2260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-