Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe
-
Size
765KB
-
MD5
4f39636a027ab4008b525c9a484e6e4d
-
SHA1
1f39f0fa92a5febfd84bbe56ca9d102e593771f7
-
SHA256
7f06a8f51c3b92b2e2bee44ca3e3211a0e88f43dffc001354dee2101eb892050
-
SHA512
a420b772b86c2cf86fd995d2a26e9d8e2a9006c8ac82c74ce2d11ee4d163f3d3a4af01eaf0a2f54187f174cd6630a1d6f366e53d02a2d6c5a155a86bcf6687cb
-
SSDEEP
12288:ZU5rCOTeiDj1JaAXEspnA2f2cgu3ZF5rn5rLOa54U5w5A:ZUQOJDpxXnhf2ru3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2268 BB92.tmp 2004 BC0F.tmp 2972 BCAB.tmp 2480 BD18.tmp 264 BD95.tmp 764 BE11.tmp 2688 BE9E.tmp 2808 BF1B.tmp 2712 BF97.tmp 2844 C005.tmp 2884 C072.tmp 2752 C0DF.tmp 2576 C15C.tmp 2704 C1E8.tmp 528 C265.tmp 1484 C301.tmp 1656 C36E.tmp 2380 C3FB.tmp 1512 C487.tmp 352 C523.tmp 1712 C590.tmp 2388 C61D.tmp 840 C68A.tmp 1324 C6C8.tmp 1744 C707.tmp 1320 C745.tmp 1212 C783.tmp 576 C7C2.tmp 2868 C800.tmp 2424 C83F.tmp 2860 C87D.tmp 2452 C8BB.tmp 1136 C8FA.tmp 2456 C938.tmp 1536 C977.tmp 1892 C9B5.tmp 1812 C9F3.tmp 328 CA32.tmp 1720 CA70.tmp 1732 CAAF.tmp 2148 CAED.tmp 1548 CB2B.tmp 1436 CB6A.tmp 2680 CBA8.tmp 2188 CBE7.tmp 2544 CC25.tmp 1628 CC63.tmp 1748 CCA2.tmp 376 CCE0.tmp 2116 CD1F.tmp 2528 CD5D.tmp 2352 CDDA.tmp 1504 CE18.tmp 2964 CE57.tmp 2004 CE95.tmp 2500 CED3.tmp 2168 CF12.tmp 1272 CF50.tmp 2912 CF8F.tmp 1128 CFCD.tmp 764 D00B.tmp 2916 D04A.tmp 2788 D088.tmp 2808 D0C7.tmp -
Loads dropped DLL 64 IoCs
pid Process 2960 2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe 2268 BB92.tmp 2004 BC0F.tmp 2972 BCAB.tmp 2480 BD18.tmp 264 BD95.tmp 764 BE11.tmp 2688 BE9E.tmp 2808 BF1B.tmp 2712 BF97.tmp 2844 C005.tmp 2884 C072.tmp 2752 C0DF.tmp 2576 C15C.tmp 2704 C1E8.tmp 528 C265.tmp 1484 C301.tmp 1656 C36E.tmp 2380 C3FB.tmp 1512 C487.tmp 352 C523.tmp 1712 C590.tmp 2388 C61D.tmp 840 C68A.tmp 1324 C6C8.tmp 1744 C707.tmp 1320 C745.tmp 1212 C783.tmp 576 C7C2.tmp 2868 C800.tmp 2424 C83F.tmp 2860 C87D.tmp 2452 C8BB.tmp 1136 C8FA.tmp 2456 C938.tmp 1536 C977.tmp 1892 C9B5.tmp 1812 C9F3.tmp 328 CA32.tmp 1720 CA70.tmp 1732 CAAF.tmp 2148 CAED.tmp 1548 CB2B.tmp 1436 CB6A.tmp 2680 CBA8.tmp 2188 CBE7.tmp 2544 CC25.tmp 1628 CC63.tmp 1748 CCA2.tmp 376 CCE0.tmp 2116 CD1F.tmp 1556 CD9B.tmp 2352 CDDA.tmp 1504 CE18.tmp 2964 CE57.tmp 2004 CE95.tmp 2500 CED3.tmp 2168 CF12.tmp 1272 CF50.tmp 2912 CF8F.tmp 1128 CFCD.tmp 764 D00B.tmp 2916 D04A.tmp 2788 D088.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD5D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E724.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7F6D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A64D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B903.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1536.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2BC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F132.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1287.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1FD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3276.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 64DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B31.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F788.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 89B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4A1A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2268 2960 2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe 30 PID 2960 wrote to memory of 2268 2960 2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe 30 PID 2960 wrote to memory of 2268 2960 2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe 30 PID 2960 wrote to memory of 2268 2960 2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe 30 PID 2268 wrote to memory of 2004 2268 BB92.tmp 31 PID 2268 wrote to memory of 2004 2268 BB92.tmp 31 PID 2268 wrote to memory of 2004 2268 BB92.tmp 31 PID 2268 wrote to memory of 2004 2268 BB92.tmp 31 PID 2004 wrote to memory of 2972 2004 BC0F.tmp 32 PID 2004 wrote to memory of 2972 2004 BC0F.tmp 32 PID 2004 wrote to memory of 2972 2004 BC0F.tmp 32 PID 2004 wrote to memory of 2972 2004 BC0F.tmp 32 PID 2972 wrote to memory of 2480 2972 BCAB.tmp 33 PID 2972 wrote to memory of 2480 2972 BCAB.tmp 33 PID 2972 wrote to memory of 2480 2972 BCAB.tmp 33 PID 2972 wrote to memory of 2480 2972 BCAB.tmp 33 PID 2480 wrote to memory of 264 2480 BD18.tmp 34 PID 2480 wrote to memory of 264 2480 BD18.tmp 34 PID 2480 wrote to memory of 264 2480 BD18.tmp 34 PID 2480 wrote to memory of 264 2480 BD18.tmp 34 PID 264 wrote to memory of 764 264 BD95.tmp 35 PID 264 wrote to memory of 764 264 BD95.tmp 35 PID 264 wrote to memory of 764 264 BD95.tmp 35 PID 264 wrote to memory of 764 264 BD95.tmp 35 PID 764 wrote to memory of 2688 764 BE11.tmp 36 PID 764 wrote to memory of 2688 764 BE11.tmp 36 PID 764 wrote to memory of 2688 764 BE11.tmp 36 PID 764 wrote to memory of 2688 764 BE11.tmp 36 PID 2688 wrote to memory of 2808 2688 BE9E.tmp 37 PID 2688 wrote to memory of 2808 2688 BE9E.tmp 37 PID 2688 wrote to memory of 2808 2688 BE9E.tmp 37 PID 2688 wrote to memory of 2808 2688 BE9E.tmp 37 PID 2808 wrote to memory of 2712 2808 BF1B.tmp 38 PID 2808 wrote to memory of 2712 2808 BF1B.tmp 38 PID 2808 wrote to memory of 2712 2808 BF1B.tmp 38 PID 2808 wrote to memory of 2712 2808 BF1B.tmp 38 PID 2712 wrote to memory of 2844 2712 BF97.tmp 39 PID 2712 wrote to memory of 2844 2712 BF97.tmp 39 PID 2712 wrote to memory of 2844 2712 BF97.tmp 39 PID 2712 wrote to memory of 2844 2712 BF97.tmp 39 PID 2844 wrote to memory of 2884 2844 C005.tmp 40 PID 2844 wrote to memory of 2884 2844 C005.tmp 40 PID 2844 wrote to memory of 2884 2844 C005.tmp 40 PID 2844 wrote to memory of 2884 2844 C005.tmp 40 PID 2884 wrote to memory of 2752 2884 C072.tmp 41 PID 2884 wrote to memory of 2752 2884 C072.tmp 41 PID 2884 wrote to memory of 2752 2884 C072.tmp 41 PID 2884 wrote to memory of 2752 2884 C072.tmp 41 PID 2752 wrote to memory of 2576 2752 C0DF.tmp 42 PID 2752 wrote to memory of 2576 2752 C0DF.tmp 42 PID 2752 wrote to memory of 2576 2752 C0DF.tmp 42 PID 2752 wrote to memory of 2576 2752 C0DF.tmp 42 PID 2576 wrote to memory of 2704 2576 C15C.tmp 43 PID 2576 wrote to memory of 2704 2576 C15C.tmp 43 PID 2576 wrote to memory of 2704 2576 C15C.tmp 43 PID 2576 wrote to memory of 2704 2576 C15C.tmp 43 PID 2704 wrote to memory of 528 2704 C1E8.tmp 44 PID 2704 wrote to memory of 528 2704 C1E8.tmp 44 PID 2704 wrote to memory of 528 2704 C1E8.tmp 44 PID 2704 wrote to memory of 528 2704 C1E8.tmp 44 PID 528 wrote to memory of 1484 528 C265.tmp 45 PID 528 wrote to memory of 1484 528 C265.tmp 45 PID 528 wrote to memory of 1484 528 C265.tmp 45 PID 528 wrote to memory of 1484 528 C265.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_4f39636a027ab4008b525c9a484e6e4d_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\BD18.tmp"C:\Users\Admin\AppData\Local\Temp\BD18.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\BD95.tmp"C:\Users\Admin\AppData\Local\Temp\BD95.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\BE11.tmp"C:\Users\Admin\AppData\Local\Temp\BE11.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"C:\Users\Admin\AppData\Local\Temp\BE9E.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"C:\Users\Admin\AppData\Local\Temp\BF1B.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\C005.tmp"C:\Users\Admin\AppData\Local\Temp\C005.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C072.tmp"C:\Users\Admin\AppData\Local\Temp\C072.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\C301.tmp"C:\Users\Admin\AppData\Local\Temp\C301.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\C36E.tmp"C:\Users\Admin\AppData\Local\Temp\C36E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"C:\Users\Admin\AppData\Local\Temp\C3FB.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\C487.tmp"C:\Users\Admin\AppData\Local\Temp\C487.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\C523.tmp"C:\Users\Admin\AppData\Local\Temp\C523.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:352 -
C:\Users\Admin\AppData\Local\Temp\C590.tmp"C:\Users\Admin\AppData\Local\Temp\C590.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"C:\Users\Admin\AppData\Local\Temp\C6C8.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\C707.tmp"C:\Users\Admin\AppData\Local\Temp\C707.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\C745.tmp"C:\Users\Admin\AppData\Local\Temp\C745.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\C783.tmp"C:\Users\Admin\AppData\Local\Temp\C783.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\C800.tmp"C:\Users\Admin\AppData\Local\Temp\C800.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\C83F.tmp"C:\Users\Admin\AppData\Local\Temp\C83F.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\C87D.tmp"C:\Users\Admin\AppData\Local\Temp\C87D.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"C:\Users\Admin\AppData\Local\Temp\C8BB.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"C:\Users\Admin\AppData\Local\Temp\C8FA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\C938.tmp"C:\Users\Admin\AppData\Local\Temp\C938.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"C:\Users\Admin\AppData\Local\Temp\C9B5.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"C:\Users\Admin\AppData\Local\Temp\C9F3.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:328 -
C:\Users\Admin\AppData\Local\Temp\CA70.tmp"C:\Users\Admin\AppData\Local\Temp\CA70.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"C:\Users\Admin\AppData\Local\Temp\CAAF.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"C:\Users\Admin\AppData\Local\Temp\CB2B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"C:\Users\Admin\AppData\Local\Temp\CB6A.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"C:\Users\Admin\AppData\Local\Temp\CBA8.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"C:\Users\Admin\AppData\Local\Temp\CBE7.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\CC25.tmp"C:\Users\Admin\AppData\Local\Temp\CC25.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\CC63.tmp"C:\Users\Admin\AppData\Local\Temp\CC63.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"C:\Users\Admin\AppData\Local\Temp\CCA2.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"C:\Users\Admin\AppData\Local\Temp\CCE0.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:376 -
C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"C:\Users\Admin\AppData\Local\Temp\CD1F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"C:\Users\Admin\AppData\Local\Temp\CD5D.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"C:\Users\Admin\AppData\Local\Temp\CD9B.tmp"53⤵
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"C:\Users\Admin\AppData\Local\Temp\CDDA.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\CE18.tmp"C:\Users\Admin\AppData\Local\Temp\CE18.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\CE57.tmp"C:\Users\Admin\AppData\Local\Temp\CE57.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\CE95.tmp"C:\Users\Admin\AppData\Local\Temp\CE95.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\CED3.tmp"C:\Users\Admin\AppData\Local\Temp\CED3.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\CF12.tmp"C:\Users\Admin\AppData\Local\Temp\CF12.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\CF50.tmp"C:\Users\Admin\AppData\Local\Temp\CF50.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"C:\Users\Admin\AppData\Local\Temp\CF8F.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"C:\Users\Admin\AppData\Local\Temp\CFCD.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\D00B.tmp"C:\Users\Admin\AppData\Local\Temp\D00B.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\D04A.tmp"C:\Users\Admin\AppData\Local\Temp\D04A.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\D088.tmp"C:\Users\Admin\AppData\Local\Temp\D088.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"C:\Users\Admin\AppData\Local\Temp\D0C7.tmp"66⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\D105.tmp"C:\Users\Admin\AppData\Local\Temp\D105.tmp"67⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"68⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"69⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"70⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"71⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"72⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"73⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"C:\Users\Admin\AppData\Local\Temp\D2BA.tmp"74⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"C:\Users\Admin\AppData\Local\Temp\D2F8.tmp"75⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D337.tmp"C:\Users\Admin\AppData\Local\Temp\D337.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\D375.tmp"C:\Users\Admin\AppData\Local\Temp\D375.tmp"77⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"C:\Users\Admin\AppData\Local\Temp\D3B3.tmp"78⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"C:\Users\Admin\AppData\Local\Temp\D3F2.tmp"79⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\D430.tmp"C:\Users\Admin\AppData\Local\Temp\D430.tmp"80⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\D46F.tmp"C:\Users\Admin\AppData\Local\Temp\D46F.tmp"81⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"C:\Users\Admin\AppData\Local\Temp\D4AD.tmp"82⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"C:\Users\Admin\AppData\Local\Temp\D4EB.tmp"83⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\D52A.tmp"C:\Users\Admin\AppData\Local\Temp\D52A.tmp"84⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\D568.tmp"C:\Users\Admin\AppData\Local\Temp\D568.tmp"85⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"C:\Users\Admin\AppData\Local\Temp\D5A7.tmp"86⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"C:\Users\Admin\AppData\Local\Temp\D5E5.tmp"87⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"88⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"89⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"90⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"91⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"92⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"93⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"94⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"95⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\D826.tmp"C:\Users\Admin\AppData\Local\Temp\D826.tmp"96⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\D865.tmp"C:\Users\Admin\AppData\Local\Temp\D865.tmp"97⤵PID:660
-
C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"C:\Users\Admin\AppData\Local\Temp\D8B3.tmp"98⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"C:\Users\Admin\AppData\Local\Temp\D8F1.tmp"99⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\D93F.tmp"C:\Users\Admin\AppData\Local\Temp\D93F.tmp"100⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\D97D.tmp"C:\Users\Admin\AppData\Local\Temp\D97D.tmp"101⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"C:\Users\Admin\AppData\Local\Temp\D9BC.tmp"102⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"C:\Users\Admin\AppData\Local\Temp\D9FA.tmp"103⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\DA39.tmp"C:\Users\Admin\AppData\Local\Temp\DA39.tmp"104⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\DA77.tmp"C:\Users\Admin\AppData\Local\Temp\DA77.tmp"105⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"C:\Users\Admin\AppData\Local\Temp\DAC5.tmp"106⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\DB03.tmp"C:\Users\Admin\AppData\Local\Temp\DB03.tmp"107⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\DB42.tmp"C:\Users\Admin\AppData\Local\Temp\DB42.tmp"108⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\DB80.tmp"C:\Users\Admin\AppData\Local\Temp\DB80.tmp"109⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"C:\Users\Admin\AppData\Local\Temp\DBBF.tmp"110⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"C:\Users\Admin\AppData\Local\Temp\DBFD.tmp"111⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"C:\Users\Admin\AppData\Local\Temp\DC3B.tmp"112⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"C:\Users\Admin\AppData\Local\Temp\DC7A.tmp"113⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"C:\Users\Admin\AppData\Local\Temp\DCB8.tmp"114⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"C:\Users\Admin\AppData\Local\Temp\DCF7.tmp"115⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\DD35.tmp"C:\Users\Admin\AppData\Local\Temp\DD35.tmp"116⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\DD73.tmp"C:\Users\Admin\AppData\Local\Temp\DD73.tmp"117⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"C:\Users\Admin\AppData\Local\Temp\DDB2.tmp"118⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"C:\Users\Admin\AppData\Local\Temp\DDF0.tmp"119⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"120⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"121⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"122⤵PID:984
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-