Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
25/09/2024, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe
-
Size
712KB
-
MD5
6bd82b5a17950940f506f2700751914c
-
SHA1
e5eb60d62eac9d798a9c4b9f12481437e51a4e77
-
SHA256
dd21655da55991c01eb4429cdb39e2e4a78079c22a67b6eaff327b9d67622473
-
SHA512
e0577b69c18b181d43f302807308ec4b20309d6587b8c0d90155b43e9f34dec2fe7c82327819fd9b9c05896bdf4926b528e54d90b5fab60a63d139f343d0ebeb
-
SSDEEP
12288:FU5rCOTeiDzzV6GT3g+LJvb1nhhrmAJNZdCvq5TJLCvY90D8/LVBlVk736Y79GWm:FUQOJD/V6r+LJhhhrzNnCvq5TJLCvY93
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1224 99B0.tmp 2416 9A0E.tmp 1740 9A7B.tmp 2356 9AF8.tmp 2460 9B46.tmp 2832 9BB3.tmp 2760 9C11.tmp 2804 9C8D.tmp 2252 9CEB.tmp 2748 9D58.tmp 2612 9DD5.tmp 2684 9E52.tmp 2664 9EBF.tmp 2004 9F2C.tmp 652 9F8A.tmp 708 A007.tmp 2680 A093.tmp 1108 A110.tmp 1480 A15E.tmp 1996 A1EA.tmp 2000 A257.tmp 2508 A2D4.tmp 2956 A332.tmp 1636 A370.tmp 1372 A3AF.tmp 2972 A3ED.tmp 2152 A42B.tmp 2320 A46A.tmp 1344 A4A8.tmp 2212 A4E7.tmp 2596 A525.tmp 1016 A563.tmp 1144 A5A2.tmp 3040 A5E0.tmp 824 A61F.tmp 1380 A66D.tmp 1272 A6AB.tmp 1332 A6E9.tmp 1552 A728.tmp 2108 A766.tmp 1696 A7A5.tmp 924 A7E3.tmp 2232 A821.tmp 2440 A860.tmp 2136 A89E.tmp 528 A8DD.tmp 1028 A90B.tmp 1040 A959.tmp 2300 A9A7.tmp 3004 A9E6.tmp 2524 AA24.tmp 2312 AA63.tmp 2520 AAA1.tmp 2360 AADF.tmp 2160 AB1E.tmp 1708 AB5C.tmp 2408 AB9B.tmp 2904 ABD9.tmp 2756 AC17.tmp 1932 AC56.tmp 2816 AC94.tmp 1936 ACE2.tmp 3024 AD21.tmp 2620 AD6F.tmp -
Loads dropped DLL 64 IoCs
pid Process 1972 2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe 1224 99B0.tmp 2416 9A0E.tmp 1740 9A7B.tmp 2356 9AF8.tmp 2460 9B46.tmp 2832 9BB3.tmp 2760 9C11.tmp 2804 9C8D.tmp 2252 9CEB.tmp 2748 9D58.tmp 2612 9DD5.tmp 2684 9E52.tmp 2664 9EBF.tmp 2004 9F2C.tmp 652 9F8A.tmp 708 A007.tmp 2680 A093.tmp 1108 A110.tmp 1480 A15E.tmp 1996 A1EA.tmp 2000 A257.tmp 2508 A2D4.tmp 2956 A332.tmp 1636 A370.tmp 1372 A3AF.tmp 2972 A3ED.tmp 2152 A42B.tmp 2320 A46A.tmp 1344 A4A8.tmp 2212 A4E7.tmp 2596 A525.tmp 1016 A563.tmp 1144 A5A2.tmp 3040 A5E0.tmp 824 A61F.tmp 1380 A66D.tmp 1272 A6AB.tmp 1332 A6E9.tmp 1552 A728.tmp 2108 A766.tmp 1696 A7A5.tmp 924 A7E3.tmp 2232 A821.tmp 2440 A860.tmp 2136 A89E.tmp 528 A8DD.tmp 1028 A90B.tmp 1040 A959.tmp 2300 A9A7.tmp 3004 A9E6.tmp 2524 AA24.tmp 2312 AA63.tmp 2520 AAA1.tmp 2360 AADF.tmp 2160 AB1E.tmp 1708 AB5C.tmp 2408 AB9B.tmp 2904 ABD9.tmp 2756 AC17.tmp 1932 AC56.tmp 2816 AC94.tmp 1936 ACE2.tmp 3024 AD21.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67A9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8288.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B37.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 70AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A15E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5052.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E705.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F75A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F94D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2868.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A110.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FAC3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D73C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 205C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE68.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4D55.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 99C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1224 1972 2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe 30 PID 1972 wrote to memory of 1224 1972 2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe 30 PID 1972 wrote to memory of 1224 1972 2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe 30 PID 1972 wrote to memory of 1224 1972 2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe 30 PID 1224 wrote to memory of 2416 1224 99B0.tmp 31 PID 1224 wrote to memory of 2416 1224 99B0.tmp 31 PID 1224 wrote to memory of 2416 1224 99B0.tmp 31 PID 1224 wrote to memory of 2416 1224 99B0.tmp 31 PID 2416 wrote to memory of 1740 2416 9A0E.tmp 32 PID 2416 wrote to memory of 1740 2416 9A0E.tmp 32 PID 2416 wrote to memory of 1740 2416 9A0E.tmp 32 PID 2416 wrote to memory of 1740 2416 9A0E.tmp 32 PID 1740 wrote to memory of 2356 1740 9A7B.tmp 33 PID 1740 wrote to memory of 2356 1740 9A7B.tmp 33 PID 1740 wrote to memory of 2356 1740 9A7B.tmp 33 PID 1740 wrote to memory of 2356 1740 9A7B.tmp 33 PID 2356 wrote to memory of 2460 2356 9AF8.tmp 34 PID 2356 wrote to memory of 2460 2356 9AF8.tmp 34 PID 2356 wrote to memory of 2460 2356 9AF8.tmp 34 PID 2356 wrote to memory of 2460 2356 9AF8.tmp 34 PID 2460 wrote to memory of 2832 2460 9B46.tmp 35 PID 2460 wrote to memory of 2832 2460 9B46.tmp 35 PID 2460 wrote to memory of 2832 2460 9B46.tmp 35 PID 2460 wrote to memory of 2832 2460 9B46.tmp 35 PID 2832 wrote to memory of 2760 2832 9BB3.tmp 36 PID 2832 wrote to memory of 2760 2832 9BB3.tmp 36 PID 2832 wrote to memory of 2760 2832 9BB3.tmp 36 PID 2832 wrote to memory of 2760 2832 9BB3.tmp 36 PID 2760 wrote to memory of 2804 2760 9C11.tmp 37 PID 2760 wrote to memory of 2804 2760 9C11.tmp 37 PID 2760 wrote to memory of 2804 2760 9C11.tmp 37 PID 2760 wrote to memory of 2804 2760 9C11.tmp 37 PID 2804 wrote to memory of 2252 2804 9C8D.tmp 38 PID 2804 wrote to memory of 2252 2804 9C8D.tmp 38 PID 2804 wrote to memory of 2252 2804 9C8D.tmp 38 PID 2804 wrote to memory of 2252 2804 9C8D.tmp 38 PID 2252 wrote to memory of 2748 2252 9CEB.tmp 39 PID 2252 wrote to memory of 2748 2252 9CEB.tmp 39 PID 2252 wrote to memory of 2748 2252 9CEB.tmp 39 PID 2252 wrote to memory of 2748 2252 9CEB.tmp 39 PID 2748 wrote to memory of 2612 2748 9D58.tmp 40 PID 2748 wrote to memory of 2612 2748 9D58.tmp 40 PID 2748 wrote to memory of 2612 2748 9D58.tmp 40 PID 2748 wrote to memory of 2612 2748 9D58.tmp 40 PID 2612 wrote to memory of 2684 2612 9DD5.tmp 41 PID 2612 wrote to memory of 2684 2612 9DD5.tmp 41 PID 2612 wrote to memory of 2684 2612 9DD5.tmp 41 PID 2612 wrote to memory of 2684 2612 9DD5.tmp 41 PID 2684 wrote to memory of 2664 2684 9E52.tmp 42 PID 2684 wrote to memory of 2664 2684 9E52.tmp 42 PID 2684 wrote to memory of 2664 2684 9E52.tmp 42 PID 2684 wrote to memory of 2664 2684 9E52.tmp 42 PID 2664 wrote to memory of 2004 2664 9EBF.tmp 43 PID 2664 wrote to memory of 2004 2664 9EBF.tmp 43 PID 2664 wrote to memory of 2004 2664 9EBF.tmp 43 PID 2664 wrote to memory of 2004 2664 9EBF.tmp 43 PID 2004 wrote to memory of 652 2004 9F2C.tmp 44 PID 2004 wrote to memory of 652 2004 9F2C.tmp 44 PID 2004 wrote to memory of 652 2004 9F2C.tmp 44 PID 2004 wrote to memory of 652 2004 9F2C.tmp 44 PID 652 wrote to memory of 708 652 9F8A.tmp 45 PID 652 wrote to memory of 708 652 9F8A.tmp 45 PID 652 wrote to memory of 708 652 9F8A.tmp 45 PID 652 wrote to memory of 708 652 9F8A.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-25_6bd82b5a17950940f506f2700751914c_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"C:\Users\Admin\AppData\Local\Temp\9C8D.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9D58.tmp"C:\Users\Admin\AppData\Local\Temp\9D58.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"C:\Users\Admin\AppData\Local\Temp\9DD5.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\9E52.tmp"C:\Users\Admin\AppData\Local\Temp\9E52.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"C:\Users\Admin\AppData\Local\Temp\9EBF.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"C:\Users\Admin\AppData\Local\Temp\9F2C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"C:\Users\Admin\AppData\Local\Temp\9F8A.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\A007.tmp"C:\Users\Admin\AppData\Local\Temp\A007.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:708 -
C:\Users\Admin\AppData\Local\Temp\A093.tmp"C:\Users\Admin\AppData\Local\Temp\A093.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"C:\Users\Admin\AppData\Local\Temp\A2D4.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\A332.tmp"C:\Users\Admin\AppData\Local\Temp\A332.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"C:\Users\Admin\AppData\Local\Temp\A3AF.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\A42B.tmp"C:\Users\Admin\AppData\Local\Temp\A42B.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\A46A.tmp"C:\Users\Admin\AppData\Local\Temp\A46A.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"C:\Users\Admin\AppData\Local\Temp\A4E7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\A525.tmp"C:\Users\Admin\AppData\Local\Temp\A525.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\A563.tmp"C:\Users\Admin\AppData\Local\Temp\A563.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"C:\Users\Admin\AppData\Local\Temp\A5A2.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A61F.tmp"C:\Users\Admin\AppData\Local\Temp\A61F.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:824 -
C:\Users\Admin\AppData\Local\Temp\A66D.tmp"C:\Users\Admin\AppData\Local\Temp\A66D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"C:\Users\Admin\AppData\Local\Temp\A6AB.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\A766.tmp"C:\Users\Admin\AppData\Local\Temp\A766.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"C:\Users\Admin\AppData\Local\Temp\A7E3.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A821.tmp"C:\Users\Admin\AppData\Local\Temp\A821.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\A89E.tmp"C:\Users\Admin\AppData\Local\Temp\A89E.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"C:\Users\Admin\AppData\Local\Temp\A8DD.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:528 -
C:\Users\Admin\AppData\Local\Temp\A90B.tmp"C:\Users\Admin\AppData\Local\Temp\A90B.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\A959.tmp"C:\Users\Admin\AppData\Local\Temp\A959.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"C:\Users\Admin\AppData\Local\Temp\A9A7.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"C:\Users\Admin\AppData\Local\Temp\A9E6.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\AA24.tmp"C:\Users\Admin\AppData\Local\Temp\AA24.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\AA63.tmp"C:\Users\Admin\AppData\Local\Temp\AA63.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"C:\Users\Admin\AppData\Local\Temp\AD6F.tmp"65⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"66⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"C:\Users\Admin\AppData\Local\Temp\ADEB.tmp"67⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"68⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\AE68.tmp"C:\Users\Admin\AppData\Local\Temp\AE68.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"70⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"71⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"72⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\AF62.tmp"C:\Users\Admin\AppData\Local\Temp\AF62.tmp"73⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"C:\Users\Admin\AppData\Local\Temp\AFA0.tmp"74⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"75⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\B02D.tmp"C:\Users\Admin\AppData\Local\Temp\B02D.tmp"76⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"77⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"78⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"C:\Users\Admin\AppData\Local\Temp\B0F7.tmp"79⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\B136.tmp"C:\Users\Admin\AppData\Local\Temp\B136.tmp"80⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\B174.tmp"C:\Users\Admin\AppData\Local\Temp\B174.tmp"81⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"C:\Users\Admin\AppData\Local\Temp\B1B3.tmp"82⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"C:\Users\Admin\AppData\Local\Temp\B1F1.tmp"83⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B22F.tmp"C:\Users\Admin\AppData\Local\Temp\B22F.tmp"84⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B26E.tmp"C:\Users\Admin\AppData\Local\Temp\B26E.tmp"85⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"C:\Users\Admin\AppData\Local\Temp\B2AC.tmp"86⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"C:\Users\Admin\AppData\Local\Temp\B2EB.tmp"87⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"88⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\B367.tmp"C:\Users\Admin\AppData\Local\Temp\B367.tmp"89⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"C:\Users\Admin\AppData\Local\Temp\B3A6.tmp"90⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"C:\Users\Admin\AppData\Local\Temp\B3E4.tmp"91⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B423.tmp"C:\Users\Admin\AppData\Local\Temp\B423.tmp"92⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"93⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"94⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"95⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"96⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"97⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"98⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"99⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\B635.tmp"C:\Users\Admin\AppData\Local\Temp\B635.tmp"100⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"101⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"C:\Users\Admin\AppData\Local\Temp\B6B2.tmp"102⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"C:\Users\Admin\AppData\Local\Temp\B6F0.tmp"103⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\B72F.tmp"C:\Users\Admin\AppData\Local\Temp\B72F.tmp"104⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"105⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"C:\Users\Admin\AppData\Local\Temp\B7BB.tmp"106⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"C:\Users\Admin\AppData\Local\Temp\B7F9.tmp"107⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"108⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\B876.tmp"C:\Users\Admin\AppData\Local\Temp\B876.tmp"109⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"C:\Users\Admin\AppData\Local\Temp\B8B5.tmp"110⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"C:\Users\Admin\AppData\Local\Temp\B8F3.tmp"111⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\B931.tmp"C:\Users\Admin\AppData\Local\Temp\B931.tmp"112⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\B97F.tmp"C:\Users\Admin\AppData\Local\Temp\B97F.tmp"113⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"C:\Users\Admin\AppData\Local\Temp\B9BE.tmp"114⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"C:\Users\Admin\AppData\Local\Temp\B9FC.tmp"115⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"C:\Users\Admin\AppData\Local\Temp\BA3B.tmp"116⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"117⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\BB05.tmp"C:\Users\Admin\AppData\Local\Temp\BB05.tmp"119⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\BB44.tmp"C:\Users\Admin\AppData\Local\Temp\BB44.tmp"120⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\BB82.tmp"C:\Users\Admin\AppData\Local\Temp\BB82.tmp"121⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"C:\Users\Admin\AppData\Local\Temp\BBC1.tmp"122⤵PID:1916
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-