Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 03:56
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe
-
Size
712KB
-
MD5
6ad7bfcb412b54b6c778a20053b82d9e
-
SHA1
127c6c109b46e1e276338bcf6e2505754058a1a5
-
SHA256
aa456142ff8ce7196ad6fa68be911a0f3db25f860ea15a6b62da856592dffc2f
-
SHA512
8c24271d97c5b9f1880eced274d00b07cbdcf826b6b41651ffc7120d33035cdd18fc6a940d7bd5d83d8b545b7c8b3221e55dca799c7a6010435ee30993ff06c9
-
SSDEEP
12288:FU5rCOTeiD0FS1HCBY36ji3uHl1fhUg8WIWWNNZdCvq5TJLCvY90D8/LVBlVk730:FUQOJDTCBYt3CxqWpENnCvq5TJLCvY93
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2388 B03C.tmp 1808 B09A.tmp 3044 B117.tmp 2308 B184.tmp 336 B1E1.tmp 2836 B24F.tmp 2784 B29D.tmp 2760 B319.tmp 3056 B367.tmp 3020 B3D5.tmp 2684 B442.tmp 2692 B4AF.tmp 2680 B50D.tmp 684 B56A.tmp 1200 B5B8.tmp 1140 B625.tmp 3012 B6A2.tmp 2888 B70F.tmp 2984 B78C.tmp 1616 B7F9.tmp 1100 B867.tmp 1964 B8E3.tmp 2004 B941.tmp 2272 B97F.tmp 3032 B9BE.tmp 2164 B9FC.tmp 2104 BA3B.tmp 840 BA79.tmp 2304 BAB7.tmp 2156 BAF6.tmp 1000 BB34.tmp 1628 BB73.tmp 2160 BBB1.tmp 272 BBEF.tmp 1356 BC2E.tmp 708 BC6C.tmp 1696 BCAB.tmp 1644 BCE9.tmp 1864 BD27.tmp 960 BD66.tmp 776 BDA4.tmp 2088 BDE3.tmp 2224 BE21.tmp 380 BE5F.tmp 2612 BE9E.tmp 2216 BEDC.tmp 2116 BF1B.tmp 916 BF59.tmp 1896 BF97.tmp 1688 BFD6.tmp 1748 C014.tmp 2064 C062.tmp 1592 C0A1.tmp 2540 C0DF.tmp 2548 C11D.tmp 1136 C15C.tmp 2080 C19A.tmp 2020 C1D9.tmp 2720 C217.tmp 1260 C255.tmp 2768 C294.tmp 2780 C2E2.tmp 2836 C330.tmp 3060 C37E.tmp -
Loads dropped DLL 64 IoCs
pid Process 1924 2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe 2388 B03C.tmp 1808 B09A.tmp 3044 B117.tmp 2308 B184.tmp 336 B1E1.tmp 2836 B24F.tmp 2784 B29D.tmp 2760 B319.tmp 3056 B367.tmp 3020 B3D5.tmp 2684 B442.tmp 2692 B4AF.tmp 2680 B50D.tmp 684 B56A.tmp 1200 B5B8.tmp 1140 B625.tmp 3012 B6A2.tmp 2888 B70F.tmp 2984 B78C.tmp 1616 B7F9.tmp 1100 B867.tmp 1964 B8E3.tmp 2004 B941.tmp 2272 B97F.tmp 3032 B9BE.tmp 2164 B9FC.tmp 2104 BA3B.tmp 840 BA79.tmp 2304 BAB7.tmp 2156 BAF6.tmp 1000 BB34.tmp 1628 BB73.tmp 2160 BBB1.tmp 272 BBEF.tmp 1356 BC2E.tmp 708 BC6C.tmp 1696 BCAB.tmp 1644 BCE9.tmp 1864 BD27.tmp 960 BD66.tmp 776 BDA4.tmp 2088 BDE3.tmp 2224 BE21.tmp 380 BE5F.tmp 2612 BE9E.tmp 2216 BEDC.tmp 2116 BF1B.tmp 916 BF59.tmp 1896 BF97.tmp 1688 BFD6.tmp 1748 C014.tmp 2064 C062.tmp 1592 C0A1.tmp 2540 C0DF.tmp 2548 C11D.tmp 1136 C15C.tmp 2080 C19A.tmp 2020 C1D9.tmp 2720 C217.tmp 1260 C255.tmp 2768 C294.tmp 2780 C2E2.tmp 2836 C330.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3AB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BCD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 95E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 231A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 403B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 944.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE49.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5ADD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D421.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1758.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D652.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E32E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 889.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A78.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D163.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2388 1924 2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe 30 PID 1924 wrote to memory of 2388 1924 2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe 30 PID 1924 wrote to memory of 2388 1924 2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe 30 PID 1924 wrote to memory of 2388 1924 2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe 30 PID 2388 wrote to memory of 1808 2388 B03C.tmp 31 PID 2388 wrote to memory of 1808 2388 B03C.tmp 31 PID 2388 wrote to memory of 1808 2388 B03C.tmp 31 PID 2388 wrote to memory of 1808 2388 B03C.tmp 31 PID 1808 wrote to memory of 3044 1808 B09A.tmp 32 PID 1808 wrote to memory of 3044 1808 B09A.tmp 32 PID 1808 wrote to memory of 3044 1808 B09A.tmp 32 PID 1808 wrote to memory of 3044 1808 B09A.tmp 32 PID 3044 wrote to memory of 2308 3044 B117.tmp 33 PID 3044 wrote to memory of 2308 3044 B117.tmp 33 PID 3044 wrote to memory of 2308 3044 B117.tmp 33 PID 3044 wrote to memory of 2308 3044 B117.tmp 33 PID 2308 wrote to memory of 336 2308 B184.tmp 34 PID 2308 wrote to memory of 336 2308 B184.tmp 34 PID 2308 wrote to memory of 336 2308 B184.tmp 34 PID 2308 wrote to memory of 336 2308 B184.tmp 34 PID 336 wrote to memory of 2836 336 B1E1.tmp 35 PID 336 wrote to memory of 2836 336 B1E1.tmp 35 PID 336 wrote to memory of 2836 336 B1E1.tmp 35 PID 336 wrote to memory of 2836 336 B1E1.tmp 35 PID 2836 wrote to memory of 2784 2836 B24F.tmp 36 PID 2836 wrote to memory of 2784 2836 B24F.tmp 36 PID 2836 wrote to memory of 2784 2836 B24F.tmp 36 PID 2836 wrote to memory of 2784 2836 B24F.tmp 36 PID 2784 wrote to memory of 2760 2784 B29D.tmp 37 PID 2784 wrote to memory of 2760 2784 B29D.tmp 37 PID 2784 wrote to memory of 2760 2784 B29D.tmp 37 PID 2784 wrote to memory of 2760 2784 B29D.tmp 37 PID 2760 wrote to memory of 3056 2760 B319.tmp 38 PID 2760 wrote to memory of 3056 2760 B319.tmp 38 PID 2760 wrote to memory of 3056 2760 B319.tmp 38 PID 2760 wrote to memory of 3056 2760 B319.tmp 38 PID 3056 wrote to memory of 3020 3056 B367.tmp 39 PID 3056 wrote to memory of 3020 3056 B367.tmp 39 PID 3056 wrote to memory of 3020 3056 B367.tmp 39 PID 3056 wrote to memory of 3020 3056 B367.tmp 39 PID 3020 wrote to memory of 2684 3020 B3D5.tmp 40 PID 3020 wrote to memory of 2684 3020 B3D5.tmp 40 PID 3020 wrote to memory of 2684 3020 B3D5.tmp 40 PID 3020 wrote to memory of 2684 3020 B3D5.tmp 40 PID 2684 wrote to memory of 2692 2684 B442.tmp 41 PID 2684 wrote to memory of 2692 2684 B442.tmp 41 PID 2684 wrote to memory of 2692 2684 B442.tmp 41 PID 2684 wrote to memory of 2692 2684 B442.tmp 41 PID 2692 wrote to memory of 2680 2692 B4AF.tmp 42 PID 2692 wrote to memory of 2680 2692 B4AF.tmp 42 PID 2692 wrote to memory of 2680 2692 B4AF.tmp 42 PID 2692 wrote to memory of 2680 2692 B4AF.tmp 42 PID 2680 wrote to memory of 684 2680 B50D.tmp 43 PID 2680 wrote to memory of 684 2680 B50D.tmp 43 PID 2680 wrote to memory of 684 2680 B50D.tmp 43 PID 2680 wrote to memory of 684 2680 B50D.tmp 43 PID 684 wrote to memory of 1200 684 B56A.tmp 44 PID 684 wrote to memory of 1200 684 B56A.tmp 44 PID 684 wrote to memory of 1200 684 B56A.tmp 44 PID 684 wrote to memory of 1200 684 B56A.tmp 44 PID 1200 wrote to memory of 1140 1200 B5B8.tmp 45 PID 1200 wrote to memory of 1140 1200 B5B8.tmp 45 PID 1200 wrote to memory of 1140 1200 B5B8.tmp 45 PID 1200 wrote to memory of 1140 1200 B5B8.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-19_6ad7bfcb412b54b6c778a20053b82d9e_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\B09A.tmp"C:\Users\Admin\AppData\Local\Temp\B09A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\B117.tmp"C:\Users\Admin\AppData\Local\Temp\B117.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\B24F.tmp"C:\Users\Admin\AppData\Local\Temp\B24F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\B319.tmp"C:\Users\Admin\AppData\Local\Temp\B319.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"C:\Users\Admin\AppData\Local\Temp\B3D5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\B50D.tmp"C:\Users\Admin\AppData\Local\Temp\B50D.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\B70F.tmp"C:\Users\Admin\AppData\Local\Temp\B70F.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\B78C.tmp"C:\Users\Admin\AppData\Local\Temp\B78C.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\B941.tmp"C:\Users\Admin\AppData\Local\Temp\B941.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:272 -
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"C:\Users\Admin\AppData\Local\Temp\BCE9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\BD27.tmp"C:\Users\Admin\AppData\Local\Temp\BD27.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\BD66.tmp"C:\Users\Admin\AppData\Local\Temp\BD66.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"C:\Users\Admin\AppData\Local\Temp\BDA4.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:776 -
C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"C:\Users\Admin\AppData\Local\Temp\BDE3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\BE21.tmp"C:\Users\Admin\AppData\Local\Temp\BE21.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"C:\Users\Admin\AppData\Local\Temp\BE5F.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"C:\Users\Admin\AppData\Local\Temp\BEDC.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\BF59.tmp"C:\Users\Admin\AppData\Local\Temp\BF59.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:916 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"C:\Users\Admin\AppData\Local\Temp\BFD6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\C255.tmp"C:\Users\Admin\AppData\Local\Temp\C255.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\C37E.tmp"C:\Users\Admin\AppData\Local\Temp\C37E.tmp"65⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"C:\Users\Admin\AppData\Local\Temp\C3BC.tmp"66⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"67⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\C439.tmp"C:\Users\Admin\AppData\Local\Temp\C439.tmp"68⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"69⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"70⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"C:\Users\Admin\AppData\Local\Temp\C4F4.tmp"71⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\C533.tmp"C:\Users\Admin\AppData\Local\Temp\C533.tmp"72⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\C571.tmp"C:\Users\Admin\AppData\Local\Temp\C571.tmp"73⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"74⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"75⤵PID:236
-
C:\Users\Admin\AppData\Local\Temp\C63C.tmp"C:\Users\Admin\AppData\Local\Temp\C63C.tmp"76⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\C67A.tmp"C:\Users\Admin\AppData\Local\Temp\C67A.tmp"77⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"78⤵PID:2980
-
C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"C:\Users\Admin\AppData\Local\Temp\C6F7.tmp"79⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\C735.tmp"C:\Users\Admin\AppData\Local\Temp\C735.tmp"80⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"81⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\C7B2.tmp"C:\Users\Admin\AppData\Local\Temp\C7B2.tmp"82⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"83⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"84⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"85⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"86⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"87⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\C948.tmp"C:\Users\Admin\AppData\Local\Temp\C948.tmp"88⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\C986.tmp"C:\Users\Admin\AppData\Local\Temp\C986.tmp"89⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"90⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\CA03.tmp"C:\Users\Admin\AppData\Local\Temp\CA03.tmp"91⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\CA41.tmp"C:\Users\Admin\AppData\Local\Temp\CA41.tmp"92⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\CA80.tmp"C:\Users\Admin\AppData\Local\Temp\CA80.tmp"93⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\CABE.tmp"C:\Users\Admin\AppData\Local\Temp\CABE.tmp"94⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"C:\Users\Admin\AppData\Local\Temp\CAFD.tmp"95⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"C:\Users\Admin\AppData\Local\Temp\CB3B.tmp"96⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\CB89.tmp"C:\Users\Admin\AppData\Local\Temp\CB89.tmp"97⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"C:\Users\Admin\AppData\Local\Temp\CBC7.tmp"98⤵PID:272
-
C:\Users\Admin\AppData\Local\Temp\CC06.tmp"C:\Users\Admin\AppData\Local\Temp\CC06.tmp"99⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\CC44.tmp"C:\Users\Admin\AppData\Local\Temp\CC44.tmp"100⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\CC83.tmp"C:\Users\Admin\AppData\Local\Temp\CC83.tmp"101⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"C:\Users\Admin\AppData\Local\Temp\CCD1.tmp"102⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"C:\Users\Admin\AppData\Local\Temp\CD0F.tmp"103⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"C:\Users\Admin\AppData\Local\Temp\CD4D.tmp"104⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"105⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"106⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"107⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"108⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"109⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"C:\Users\Admin\AppData\Local\Temp\CEF3.tmp"110⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CF31.tmp"C:\Users\Admin\AppData\Local\Temp\CF31.tmp"111⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"C:\Users\Admin\AppData\Local\Temp\CF6F.tmp"112⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"C:\Users\Admin\AppData\Local\Temp\CFAE.tmp"113⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"114⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"115⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\D069.tmp"C:\Users\Admin\AppData\Local\Temp\D069.tmp"116⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"C:\Users\Admin\AppData\Local\Temp\D0A7.tmp"117⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"C:\Users\Admin\AppData\Local\Temp\D0E6.tmp"118⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\D124.tmp"C:\Users\Admin\AppData\Local\Temp\D124.tmp"119⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D163.tmp"C:\Users\Admin\AppData\Local\Temp\D163.tmp"120⤵
- System Location Discovery: System Language Discovery
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"C:\Users\Admin\AppData\Local\Temp\D1B1.tmp"121⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"C:\Users\Admin\AppData\Local\Temp\D1EF.tmp"122⤵PID:2020
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-