Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe
-
Size
486KB
-
MD5
6eaf3c98239266487a682cdb2ffcc1a8
-
SHA1
1ff118dc4a36cf30ca94dad37e9a838bc485c73b
-
SHA256
119d1b67c6448425a550d1b7d513211f92b201ca755629e59b3515680858cf12
-
SHA512
8ce51c8eb3d20ca3cbdfb84ea31f840090c66c4023f4cd0002695ae8267c9de5195c20dd8b7b4c73a586e703d31c5a96048ebfe6344e8530654f102239c94b84
-
SSDEEP
12288:UU5rCOTeiDgmy9wDXUulf2tRqvyZTxjnxnpNZ:UUQOJDJIwDXZlutYKRx3N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1740 816F.tmp 1664 81DD.tmp 2720 824A.tmp 2820 8288.tmp 2488 82C7.tmp 2764 8315.tmp 2860 8363.tmp 2392 83D0.tmp 2796 840E.tmp 2660 845C.tmp 2684 849B.tmp 2656 84E9.tmp 2536 8546.tmp 1916 85A4.tmp 1116 85E2.tmp 2952 8630.tmp 2876 866F.tmp 2812 86AD.tmp 2724 86EB.tmp 3036 8739.tmp 2696 8778.tmp 1464 87B6.tmp 1692 87F5.tmp 2084 8833.tmp 1796 8871.tmp 576 88BF.tmp 2448 88FE.tmp 468 894C.tmp 2088 899A.tmp 2432 89D8.tmp 1124 8A17.tmp 2068 8A55.tmp 2172 8A84.tmp 2336 8AC2.tmp 2344 8B01.tmp 1096 8B3F.tmp 1108 8B7D.tmp 1248 8BBC.tmp 1708 8BFA.tmp 2104 8C39.tmp 1548 8C77.tmp 956 8CB5.tmp 2212 8CF4.tmp 2416 8D32.tmp 2376 8D71.tmp 356 8DAF.tmp 2528 8E0D.tmp 844 8E4B.tmp 2504 8E89.tmp 1948 8EC8.tmp 800 8F06.tmp 2292 8F45.tmp 1544 8F83.tmp 1900 8FB2.tmp 1652 8FF0.tmp 2572 902F.tmp 1984 906D.tmp 2716 909C.tmp 2744 90DA.tmp 2840 9109.tmp 2872 9138.tmp 2764 9176.tmp 2340 91B5.tmp 2892 91E3.tmp -
Loads dropped DLL 64 IoCs
pid Process 1620 2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe 1740 816F.tmp 1664 81DD.tmp 2720 824A.tmp 2820 8288.tmp 2488 82C7.tmp 2764 8315.tmp 2860 8363.tmp 2392 83D0.tmp 2796 840E.tmp 2660 845C.tmp 2684 849B.tmp 2656 84E9.tmp 2536 8546.tmp 1916 85A4.tmp 1116 85E2.tmp 2952 8630.tmp 2876 866F.tmp 2812 86AD.tmp 2724 86EB.tmp 3036 8739.tmp 2696 8778.tmp 1464 87B6.tmp 1692 87F5.tmp 2084 8833.tmp 1796 8871.tmp 576 88BF.tmp 2448 88FE.tmp 468 894C.tmp 2088 899A.tmp 2432 89D8.tmp 1124 8A17.tmp 2068 8A55.tmp 2172 8A84.tmp 2336 8AC2.tmp 2344 8B01.tmp 1096 8B3F.tmp 1108 8B7D.tmp 1248 8BBC.tmp 1708 8BFA.tmp 2104 8C39.tmp 1548 8C77.tmp 956 8CB5.tmp 2212 8CF4.tmp 2416 8D32.tmp 2376 8D71.tmp 356 8DAF.tmp 2528 8E0D.tmp 844 8E4B.tmp 2504 8E89.tmp 1948 8EC8.tmp 800 8F06.tmp 2292 8F45.tmp 1544 8F83.tmp 1900 8FB2.tmp 1652 8FF0.tmp 2572 902F.tmp 1984 906D.tmp 2716 909C.tmp 2744 90DA.tmp 2840 9109.tmp 2872 9138.tmp 2764 9176.tmp 2340 91B5.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 620D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B22.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F93D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6A57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECCF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2923.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A99.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E30F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1075.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2858.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 866F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 192C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D39.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A1C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A563.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2655.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C37E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 366C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BBFF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DB71.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1740 1620 2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe 30 PID 1620 wrote to memory of 1740 1620 2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe 30 PID 1620 wrote to memory of 1740 1620 2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe 30 PID 1620 wrote to memory of 1740 1620 2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe 30 PID 1740 wrote to memory of 1664 1740 816F.tmp 31 PID 1740 wrote to memory of 1664 1740 816F.tmp 31 PID 1740 wrote to memory of 1664 1740 816F.tmp 31 PID 1740 wrote to memory of 1664 1740 816F.tmp 31 PID 1664 wrote to memory of 2720 1664 81DD.tmp 32 PID 1664 wrote to memory of 2720 1664 81DD.tmp 32 PID 1664 wrote to memory of 2720 1664 81DD.tmp 32 PID 1664 wrote to memory of 2720 1664 81DD.tmp 32 PID 2720 wrote to memory of 2820 2720 824A.tmp 33 PID 2720 wrote to memory of 2820 2720 824A.tmp 33 PID 2720 wrote to memory of 2820 2720 824A.tmp 33 PID 2720 wrote to memory of 2820 2720 824A.tmp 33 PID 2820 wrote to memory of 2488 2820 8288.tmp 34 PID 2820 wrote to memory of 2488 2820 8288.tmp 34 PID 2820 wrote to memory of 2488 2820 8288.tmp 34 PID 2820 wrote to memory of 2488 2820 8288.tmp 34 PID 2488 wrote to memory of 2764 2488 82C7.tmp 91 PID 2488 wrote to memory of 2764 2488 82C7.tmp 91 PID 2488 wrote to memory of 2764 2488 82C7.tmp 91 PID 2488 wrote to memory of 2764 2488 82C7.tmp 91 PID 2764 wrote to memory of 2860 2764 8315.tmp 36 PID 2764 wrote to memory of 2860 2764 8315.tmp 36 PID 2764 wrote to memory of 2860 2764 8315.tmp 36 PID 2764 wrote to memory of 2860 2764 8315.tmp 36 PID 2860 wrote to memory of 2392 2860 8363.tmp 37 PID 2860 wrote to memory of 2392 2860 8363.tmp 37 PID 2860 wrote to memory of 2392 2860 8363.tmp 37 PID 2860 wrote to memory of 2392 2860 8363.tmp 37 PID 2392 wrote to memory of 2796 2392 83D0.tmp 38 PID 2392 wrote to memory of 2796 2392 83D0.tmp 38 PID 2392 wrote to memory of 2796 2392 83D0.tmp 38 PID 2392 wrote to memory of 2796 2392 83D0.tmp 38 PID 2796 wrote to memory of 2660 2796 840E.tmp 39 PID 2796 wrote to memory of 2660 2796 840E.tmp 39 PID 2796 wrote to memory of 2660 2796 840E.tmp 39 PID 2796 wrote to memory of 2660 2796 840E.tmp 39 PID 2660 wrote to memory of 2684 2660 845C.tmp 40 PID 2660 wrote to memory of 2684 2660 845C.tmp 40 PID 2660 wrote to memory of 2684 2660 845C.tmp 40 PID 2660 wrote to memory of 2684 2660 845C.tmp 40 PID 2684 wrote to memory of 2656 2684 849B.tmp 41 PID 2684 wrote to memory of 2656 2684 849B.tmp 41 PID 2684 wrote to memory of 2656 2684 849B.tmp 41 PID 2684 wrote to memory of 2656 2684 849B.tmp 41 PID 2656 wrote to memory of 2536 2656 84E9.tmp 42 PID 2656 wrote to memory of 2536 2656 84E9.tmp 42 PID 2656 wrote to memory of 2536 2656 84E9.tmp 42 PID 2656 wrote to memory of 2536 2656 84E9.tmp 42 PID 2536 wrote to memory of 1916 2536 8546.tmp 43 PID 2536 wrote to memory of 1916 2536 8546.tmp 43 PID 2536 wrote to memory of 1916 2536 8546.tmp 43 PID 2536 wrote to memory of 1916 2536 8546.tmp 43 PID 1916 wrote to memory of 1116 1916 85A4.tmp 44 PID 1916 wrote to memory of 1116 1916 85A4.tmp 44 PID 1916 wrote to memory of 1116 1916 85A4.tmp 44 PID 1916 wrote to memory of 1116 1916 85A4.tmp 44 PID 1116 wrote to memory of 2952 1116 85E2.tmp 45 PID 1116 wrote to memory of 2952 1116 85E2.tmp 45 PID 1116 wrote to memory of 2952 1116 85E2.tmp 45 PID 1116 wrote to memory of 2952 1116 85E2.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_6eaf3c98239266487a682cdb2ffcc1a8_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\816F.tmp"C:\Users\Admin\AppData\Local\Temp\816F.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\824A.tmp"C:\Users\Admin\AppData\Local\Temp\824A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\8288.tmp"C:\Users\Admin\AppData\Local\Temp\8288.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\8363.tmp"C:\Users\Admin\AppData\Local\Temp\8363.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\83D0.tmp"C:\Users\Admin\AppData\Local\Temp\83D0.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\840E.tmp"C:\Users\Admin\AppData\Local\Temp\840E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\84E9.tmp"C:\Users\Admin\AppData\Local\Temp\84E9.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\8546.tmp"C:\Users\Admin\AppData\Local\Temp\8546.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\85E2.tmp"C:\Users\Admin\AppData\Local\Temp\85E2.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\866F.tmp"C:\Users\Admin\AppData\Local\Temp\866F.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\8739.tmp"C:\Users\Admin\AppData\Local\Temp\8739.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\8778.tmp"C:\Users\Admin\AppData\Local\Temp\8778.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\87B6.tmp"C:\Users\Admin\AppData\Local\Temp\87B6.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\87F5.tmp"C:\Users\Admin\AppData\Local\Temp\87F5.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\88BF.tmp"C:\Users\Admin\AppData\Local\Temp\88BF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\88FE.tmp"C:\Users\Admin\AppData\Local\Temp\88FE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\894C.tmp"C:\Users\Admin\AppData\Local\Temp\894C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:468 -
C:\Users\Admin\AppData\Local\Temp\899A.tmp"C:\Users\Admin\AppData\Local\Temp\899A.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\89D8.tmp"C:\Users\Admin\AppData\Local\Temp\89D8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\8A17.tmp"C:\Users\Admin\AppData\Local\Temp\8A17.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\8A55.tmp"C:\Users\Admin\AppData\Local\Temp\8A55.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\8A84.tmp"C:\Users\Admin\AppData\Local\Temp\8A84.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"C:\Users\Admin\AppData\Local\Temp\8B3F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\8C39.tmp"C:\Users\Admin\AppData\Local\Temp\8C39.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8C77.tmp"C:\Users\Admin\AppData\Local\Temp\8C77.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"C:\Users\Admin\AppData\Local\Temp\8CB5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"C:\Users\Admin\AppData\Local\Temp\8CF4.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\8D32.tmp"C:\Users\Admin\AppData\Local\Temp\8D32.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\8D71.tmp"C:\Users\Admin\AppData\Local\Temp\8D71.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"C:\Users\Admin\AppData\Local\Temp\8E0D.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"C:\Users\Admin\AppData\Local\Temp\8E4B.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\8E89.tmp"C:\Users\Admin\AppData\Local\Temp\8E89.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"C:\Users\Admin\AppData\Local\Temp\8EC8.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8F06.tmp"C:\Users\Admin\AppData\Local\Temp\8F06.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:800 -
C:\Users\Admin\AppData\Local\Temp\8F45.tmp"C:\Users\Admin\AppData\Local\Temp\8F45.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"C:\Users\Admin\AppData\Local\Temp\8FB2.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"C:\Users\Admin\AppData\Local\Temp\8FF0.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\902F.tmp"C:\Users\Admin\AppData\Local\Temp\902F.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\906D.tmp"C:\Users\Admin\AppData\Local\Temp\906D.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\9109.tmp"C:\Users\Admin\AppData\Local\Temp\9109.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\9138.tmp"C:\Users\Admin\AppData\Local\Temp\9138.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\9176.tmp"C:\Users\Admin\AppData\Local\Temp\9176.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\91B5.tmp"C:\Users\Admin\AppData\Local\Temp\91B5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"65⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"66⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"67⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\928F.tmp"C:\Users\Admin\AppData\Local\Temp\928F.tmp"68⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\92BE.tmp"C:\Users\Admin\AppData\Local\Temp\92BE.tmp"69⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\92FC.tmp"C:\Users\Admin\AppData\Local\Temp\92FC.tmp"70⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\933B.tmp"C:\Users\Admin\AppData\Local\Temp\933B.tmp"71⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\9369.tmp"C:\Users\Admin\AppData\Local\Temp\9369.tmp"72⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\93A8.tmp"C:\Users\Admin\AppData\Local\Temp\93A8.tmp"73⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"74⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"75⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\9482.tmp"C:\Users\Admin\AppData\Local\Temp\9482.tmp"76⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\94C1.tmp"C:\Users\Admin\AppData\Local\Temp\94C1.tmp"77⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\94FF.tmp"C:\Users\Admin\AppData\Local\Temp\94FF.tmp"78⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\954D.tmp"C:\Users\Admin\AppData\Local\Temp\954D.tmp"79⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\958B.tmp"C:\Users\Admin\AppData\Local\Temp\958B.tmp"80⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\95CA.tmp"C:\Users\Admin\AppData\Local\Temp\95CA.tmp"81⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\9608.tmp"C:\Users\Admin\AppData\Local\Temp\9608.tmp"82⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9647.tmp"C:\Users\Admin\AppData\Local\Temp\9647.tmp"83⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\9675.tmp"C:\Users\Admin\AppData\Local\Temp\9675.tmp"84⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\96B4.tmp"C:\Users\Admin\AppData\Local\Temp\96B4.tmp"85⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"86⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"87⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\976F.tmp"C:\Users\Admin\AppData\Local\Temp\976F.tmp"88⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\97AD.tmp"C:\Users\Admin\AppData\Local\Temp\97AD.tmp"89⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\97EC.tmp"C:\Users\Admin\AppData\Local\Temp\97EC.tmp"90⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\982A.tmp"C:\Users\Admin\AppData\Local\Temp\982A.tmp"91⤵PID:2448
-
C:\Users\Admin\AppData\Local\Temp\9869.tmp"C:\Users\Admin\AppData\Local\Temp\9869.tmp"92⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\98B7.tmp"C:\Users\Admin\AppData\Local\Temp\98B7.tmp"93⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\9905.tmp"C:\Users\Admin\AppData\Local\Temp\9905.tmp"94⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\9962.tmp"C:\Users\Admin\AppData\Local\Temp\9962.tmp"95⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\99C0.tmp"C:\Users\Admin\AppData\Local\Temp\99C0.tmp"96⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"97⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"C:\Users\Admin\AppData\Local\Temp\9A3D.tmp"98⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"99⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"100⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"101⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"102⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"103⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"104⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\9C20.tmp"C:\Users\Admin\AppData\Local\Temp\9C20.tmp"105⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"106⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"C:\Users\Admin\AppData\Local\Temp\9C9D.tmp"107⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"C:\Users\Admin\AppData\Local\Temp\9CDB.tmp"108⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9D39.tmp"C:\Users\Admin\AppData\Local\Temp\9D39.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\9D97.tmp"C:\Users\Admin\AppData\Local\Temp\9D97.tmp"110⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"C:\Users\Admin\AppData\Local\Temp\9DF4.tmp"111⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\9E42.tmp"C:\Users\Admin\AppData\Local\Temp\9E42.tmp"112⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"C:\Users\Admin\AppData\Local\Temp\9EAF.tmp"113⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"C:\Users\Admin\AppData\Local\Temp\9F0D.tmp"114⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"C:\Users\Admin\AppData\Local\Temp\9F6B.tmp"115⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"C:\Users\Admin\AppData\Local\Temp\9FB9.tmp"116⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"C:\Users\Admin\AppData\Local\Temp\9FF7.tmp"117⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\A035.tmp"C:\Users\Admin\AppData\Local\Temp\A035.tmp"118⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\A074.tmp"C:\Users\Admin\AppData\Local\Temp\A074.tmp"119⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"120⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"C:\Users\Admin\AppData\Local\Temp\A0F1.tmp"121⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\A12F.tmp"C:\Users\Admin\AppData\Local\Temp\A12F.tmp"122⤵PID:2572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-