Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe
-
Size
529KB
-
MD5
8507051dda0c13623d976e8e3c03c0c6
-
SHA1
7536249fa4ac2e4e3d5dc2951f11a22537809d85
-
SHA256
144f76faa5c71d9b911379164e784bc5a92b181b02f99d3086c20ab4799a71c4
-
SHA512
80b5d599bf54e895734dc21c52238ebbed906758bee3e39b042903ccd994a92fef9a019d06810fd9768686119913a38fa5ad4239ba4c10b8571cd466d635ab9f
-
SSDEEP
12288:NU5rCOTeijBYYjuVc2oGnOrptBaTZwlH4Hp:NUQOJjBYwD8nOlCTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2848 6DFF.tmp 1760 6E4D.tmp 2656 6EAB.tmp 2592 6F08.tmp 2640 6F56.tmp 2480 6F95.tmp 2544 6FD3.tmp 2560 7040.tmp 2476 708E.tmp 2948 70DC.tmp 2952 712A.tmp 1600 7188.tmp 112 71F5.tmp 1420 7233.tmp 1704 72B0.tmp 2840 72EF.tmp 1272 732D.tmp 1452 739A.tmp 2812 73E8.tmp 2820 7446.tmp 2108 7484.tmp 2188 74F1.tmp 1904 756E.tmp 1800 75BC.tmp 1556 75FB.tmp 1984 7639.tmp 1868 7677.tmp 3068 76B6.tmp 3020 76F4.tmp 1712 7723.tmp 2072 7761.tmp 1628 77A0.tmp 1596 77DE.tmp 1632 781D.tmp 1464 785B.tmp 2516 7899.tmp 1864 78D8.tmp 1532 7916.tmp 2704 7955.tmp 380 7993.tmp 780 79E1.tmp 2992 7A2F.tmp 756 7A7D.tmp 2364 7ACB.tmp 2332 7B29.tmp 2328 7B77.tmp 2260 7BC5.tmp 2636 7C03.tmp 868 7C51.tmp 2204 7C9F.tmp 2124 7CED.tmp 2068 7D2B.tmp 1564 7D6A.tmp 1684 7DB8.tmp 2552 7E15.tmp 2596 7E54.tmp 2732 7E92.tmp 2604 7ED1.tmp 2876 7F0F.tmp 2564 7F4D.tmp 2548 7F8C.tmp 3040 7FCA.tmp 2620 8009.tmp 2060 8047.tmp -
Loads dropped DLL 64 IoCs
pid Process 2324 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 2848 6DFF.tmp 1760 6E4D.tmp 2656 6EAB.tmp 2592 6F08.tmp 2640 6F56.tmp 2480 6F95.tmp 2544 6FD3.tmp 2560 7040.tmp 2476 708E.tmp 2948 70DC.tmp 2952 712A.tmp 1600 7188.tmp 112 71F5.tmp 1420 7233.tmp 1704 72B0.tmp 2840 72EF.tmp 1272 732D.tmp 1452 739A.tmp 2812 73E8.tmp 2820 7446.tmp 2108 7484.tmp 2188 74F1.tmp 1904 756E.tmp 1800 75BC.tmp 1556 75FB.tmp 1984 7639.tmp 1868 7677.tmp 3068 76B6.tmp 3020 76F4.tmp 1712 7723.tmp 2072 7761.tmp 1628 77A0.tmp 1596 77DE.tmp 1632 781D.tmp 1464 785B.tmp 2516 7899.tmp 1864 78D8.tmp 1532 7916.tmp 2704 7955.tmp 380 7993.tmp 780 79E1.tmp 2992 7A2F.tmp 756 7A7D.tmp 2364 7ACB.tmp 2332 7B29.tmp 2328 7B77.tmp 2260 7BC5.tmp 2636 7C03.tmp 868 7C51.tmp 2204 7C9F.tmp 2124 7CED.tmp 2068 7D2B.tmp 1564 7D6A.tmp 1684 7DB8.tmp 2552 7E15.tmp 2596 7E54.tmp 2732 7E92.tmp 2604 7ED1.tmp 2876 7F0F.tmp 2564 7F4D.tmp 2548 7F8C.tmp 3040 7FCA.tmp 2620 8009.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C9A5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB6C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9BE2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E08.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A110.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA2B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E4B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCC8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5264.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 369A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8353.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA34.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C63C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 691F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33AE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7677.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 117E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 13EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9731.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B358.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C301.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79E1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2848 2324 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 29 PID 2324 wrote to memory of 2848 2324 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 29 PID 2324 wrote to memory of 2848 2324 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 29 PID 2324 wrote to memory of 2848 2324 2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe 29 PID 2848 wrote to memory of 1760 2848 6DFF.tmp 30 PID 2848 wrote to memory of 1760 2848 6DFF.tmp 30 PID 2848 wrote to memory of 1760 2848 6DFF.tmp 30 PID 2848 wrote to memory of 1760 2848 6DFF.tmp 30 PID 1760 wrote to memory of 2656 1760 6E4D.tmp 31 PID 1760 wrote to memory of 2656 1760 6E4D.tmp 31 PID 1760 wrote to memory of 2656 1760 6E4D.tmp 31 PID 1760 wrote to memory of 2656 1760 6E4D.tmp 31 PID 2656 wrote to memory of 2592 2656 6EAB.tmp 32 PID 2656 wrote to memory of 2592 2656 6EAB.tmp 32 PID 2656 wrote to memory of 2592 2656 6EAB.tmp 32 PID 2656 wrote to memory of 2592 2656 6EAB.tmp 32 PID 2592 wrote to memory of 2640 2592 6F08.tmp 33 PID 2592 wrote to memory of 2640 2592 6F08.tmp 33 PID 2592 wrote to memory of 2640 2592 6F08.tmp 33 PID 2592 wrote to memory of 2640 2592 6F08.tmp 33 PID 2640 wrote to memory of 2480 2640 6F56.tmp 34 PID 2640 wrote to memory of 2480 2640 6F56.tmp 34 PID 2640 wrote to memory of 2480 2640 6F56.tmp 34 PID 2640 wrote to memory of 2480 2640 6F56.tmp 34 PID 2480 wrote to memory of 2544 2480 6F95.tmp 35 PID 2480 wrote to memory of 2544 2480 6F95.tmp 35 PID 2480 wrote to memory of 2544 2480 6F95.tmp 35 PID 2480 wrote to memory of 2544 2480 6F95.tmp 35 PID 2544 wrote to memory of 2560 2544 6FD3.tmp 36 PID 2544 wrote to memory of 2560 2544 6FD3.tmp 36 PID 2544 wrote to memory of 2560 2544 6FD3.tmp 36 PID 2544 wrote to memory of 2560 2544 6FD3.tmp 36 PID 2560 wrote to memory of 2476 2560 7040.tmp 37 PID 2560 wrote to memory of 2476 2560 7040.tmp 37 PID 2560 wrote to memory of 2476 2560 7040.tmp 37 PID 2560 wrote to memory of 2476 2560 7040.tmp 37 PID 2476 wrote to memory of 2948 2476 708E.tmp 38 PID 2476 wrote to memory of 2948 2476 708E.tmp 38 PID 2476 wrote to memory of 2948 2476 708E.tmp 38 PID 2476 wrote to memory of 2948 2476 708E.tmp 38 PID 2948 wrote to memory of 2952 2948 70DC.tmp 39 PID 2948 wrote to memory of 2952 2948 70DC.tmp 39 PID 2948 wrote to memory of 2952 2948 70DC.tmp 39 PID 2948 wrote to memory of 2952 2948 70DC.tmp 39 PID 2952 wrote to memory of 1600 2952 712A.tmp 40 PID 2952 wrote to memory of 1600 2952 712A.tmp 40 PID 2952 wrote to memory of 1600 2952 712A.tmp 40 PID 2952 wrote to memory of 1600 2952 712A.tmp 40 PID 1600 wrote to memory of 112 1600 7188.tmp 41 PID 1600 wrote to memory of 112 1600 7188.tmp 41 PID 1600 wrote to memory of 112 1600 7188.tmp 41 PID 1600 wrote to memory of 112 1600 7188.tmp 41 PID 112 wrote to memory of 1420 112 71F5.tmp 42 PID 112 wrote to memory of 1420 112 71F5.tmp 42 PID 112 wrote to memory of 1420 112 71F5.tmp 42 PID 112 wrote to memory of 1420 112 71F5.tmp 42 PID 1420 wrote to memory of 1704 1420 7233.tmp 43 PID 1420 wrote to memory of 1704 1420 7233.tmp 43 PID 1420 wrote to memory of 1704 1420 7233.tmp 43 PID 1420 wrote to memory of 1704 1420 7233.tmp 43 PID 1704 wrote to memory of 2840 1704 72B0.tmp 44 PID 1704 wrote to memory of 2840 1704 72B0.tmp 44 PID 1704 wrote to memory of 2840 1704 72B0.tmp 44 PID 1704 wrote to memory of 2840 1704 72B0.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-27_8507051dda0c13623d976e8e3c03c0c6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"C:\Users\Admin\AppData\Local\Temp\6E4D.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"C:\Users\Admin\AppData\Local\Temp\6EAB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\6F08.tmp"C:\Users\Admin\AppData\Local\Temp\6F08.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6F56.tmp"C:\Users\Admin\AppData\Local\Temp\6F56.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6F95.tmp"C:\Users\Admin\AppData\Local\Temp\6F95.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"C:\Users\Admin\AppData\Local\Temp\6FD3.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\7040.tmp"C:\Users\Admin\AppData\Local\Temp\7040.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\708E.tmp"C:\Users\Admin\AppData\Local\Temp\708E.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\70DC.tmp"C:\Users\Admin\AppData\Local\Temp\70DC.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\712A.tmp"C:\Users\Admin\AppData\Local\Temp\712A.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\7188.tmp"C:\Users\Admin\AppData\Local\Temp\7188.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\71F5.tmp"C:\Users\Admin\AppData\Local\Temp\71F5.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\7233.tmp"C:\Users\Admin\AppData\Local\Temp\7233.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\72B0.tmp"C:\Users\Admin\AppData\Local\Temp\72B0.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\72EF.tmp"C:\Users\Admin\AppData\Local\Temp\72EF.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\732D.tmp"C:\Users\Admin\AppData\Local\Temp\732D.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\7446.tmp"C:\Users\Admin\AppData\Local\Temp\7446.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\7677.tmp"C:\Users\Admin\AppData\Local\Temp\7677.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\76F4.tmp"C:\Users\Admin\AppData\Local\Temp\76F4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\7761.tmp"C:\Users\Admin\AppData\Local\Temp\7761.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\77A0.tmp"C:\Users\Admin\AppData\Local\Temp\77A0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\781D.tmp"C:\Users\Admin\AppData\Local\Temp\781D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7899.tmp"C:\Users\Admin\AppData\Local\Temp\7899.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\78D8.tmp"C:\Users\Admin\AppData\Local\Temp\78D8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\7955.tmp"C:\Users\Admin\AppData\Local\Temp\7955.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7993.tmp"C:\Users\Admin\AppData\Local\Temp\7993.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\79E1.tmp"C:\Users\Admin\AppData\Local\Temp\79E1.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:780 -
C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"C:\Users\Admin\AppData\Local\Temp\7A2F.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"C:\Users\Admin\AppData\Local\Temp\7A7D.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756 -
C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"C:\Users\Admin\AppData\Local\Temp\7ACB.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\7B29.tmp"C:\Users\Admin\AppData\Local\Temp\7B29.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7B77.tmp"C:\Users\Admin\AppData\Local\Temp\7B77.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"C:\Users\Admin\AppData\Local\Temp\7BC5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\7C03.tmp"C:\Users\Admin\AppData\Local\Temp\7C03.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\7C51.tmp"C:\Users\Admin\AppData\Local\Temp\7C51.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:868 -
C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"C:\Users\Admin\AppData\Local\Temp\7C9F.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"C:\Users\Admin\AppData\Local\Temp\7D6A.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"C:\Users\Admin\AppData\Local\Temp\7DB8.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7E15.tmp"C:\Users\Admin\AppData\Local\Temp\7E15.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\7E54.tmp"C:\Users\Admin\AppData\Local\Temp\7E54.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\7E92.tmp"C:\Users\Admin\AppData\Local\Temp\7E92.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"C:\Users\Admin\AppData\Local\Temp\7F0F.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"C:\Users\Admin\AppData\Local\Temp\7F8C.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\8009.tmp"C:\Users\Admin\AppData\Local\Temp\8009.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8047.tmp"C:\Users\Admin\AppData\Local\Temp\8047.tmp"65⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"66⤵
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"67⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"68⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\8160.tmp"C:\Users\Admin\AppData\Local\Temp\8160.tmp"69⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"70⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\81DD.tmp"C:\Users\Admin\AppData\Local\Temp\81DD.tmp"71⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\821B.tmp"C:\Users\Admin\AppData\Local\Temp\821B.tmp"72⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8259.tmp"C:\Users\Admin\AppData\Local\Temp\8259.tmp"73⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\8298.tmp"C:\Users\Admin\AppData\Local\Temp\8298.tmp"74⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\82D6.tmp"C:\Users\Admin\AppData\Local\Temp\82D6.tmp"75⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\8315.tmp"C:\Users\Admin\AppData\Local\Temp\8315.tmp"76⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\8353.tmp"C:\Users\Admin\AppData\Local\Temp\8353.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\83A1.tmp"C:\Users\Admin\AppData\Local\Temp\83A1.tmp"78⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\83DF.tmp"C:\Users\Admin\AppData\Local\Temp\83DF.tmp"79⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\841E.tmp"C:\Users\Admin\AppData\Local\Temp\841E.tmp"80⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\845C.tmp"C:\Users\Admin\AppData\Local\Temp\845C.tmp"81⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\849B.tmp"C:\Users\Admin\AppData\Local\Temp\849B.tmp"82⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\84D9.tmp"C:\Users\Admin\AppData\Local\Temp\84D9.tmp"83⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8517.tmp"C:\Users\Admin\AppData\Local\Temp\8517.tmp"84⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"85⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\85A4.tmp"C:\Users\Admin\AppData\Local\Temp\85A4.tmp"86⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\85E2.tmp"C:\Users\Admin\AppData\Local\Temp\85E2.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\8621.tmp"C:\Users\Admin\AppData\Local\Temp\8621.tmp"88⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\865F.tmp"C:\Users\Admin\AppData\Local\Temp\865F.tmp"89⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\86AD.tmp"C:\Users\Admin\AppData\Local\Temp\86AD.tmp"90⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\86EB.tmp"C:\Users\Admin\AppData\Local\Temp\86EB.tmp"91⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\872A.tmp"C:\Users\Admin\AppData\Local\Temp\872A.tmp"92⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\8768.tmp"C:\Users\Admin\AppData\Local\Temp\8768.tmp"93⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\87A7.tmp"C:\Users\Admin\AppData\Local\Temp\87A7.tmp"94⤵PID:296
-
C:\Users\Admin\AppData\Local\Temp\87E5.tmp"C:\Users\Admin\AppData\Local\Temp\87E5.tmp"95⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\8833.tmp"C:\Users\Admin\AppData\Local\Temp\8833.tmp"96⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8871.tmp"C:\Users\Admin\AppData\Local\Temp\8871.tmp"97⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"98⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"99⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"100⤵PID:356
-
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"101⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\89A9.tmp"C:\Users\Admin\AppData\Local\Temp\89A9.tmp"102⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\89E8.tmp"C:\Users\Admin\AppData\Local\Temp\89E8.tmp"103⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\8A26.tmp"C:\Users\Admin\AppData\Local\Temp\8A26.tmp"104⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\8A65.tmp"C:\Users\Admin\AppData\Local\Temp\8A65.tmp"105⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"C:\Users\Admin\AppData\Local\Temp\8AA3.tmp"106⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"C:\Users\Admin\AppData\Local\Temp\8AE1.tmp"107⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"C:\Users\Admin\AppData\Local\Temp\8B2F.tmp"108⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"C:\Users\Admin\AppData\Local\Temp\8B7D.tmp"109⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"C:\Users\Admin\AppData\Local\Temp\8BBC.tmp"110⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"C:\Users\Admin\AppData\Local\Temp\8BFA.tmp"111⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8C48.tmp"C:\Users\Admin\AppData\Local\Temp\8C48.tmp"112⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\8C87.tmp"C:\Users\Admin\AppData\Local\Temp\8C87.tmp"113⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"C:\Users\Admin\AppData\Local\Temp\8CC5.tmp"114⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\8D03.tmp"C:\Users\Admin\AppData\Local\Temp\8D03.tmp"115⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\8D42.tmp"C:\Users\Admin\AppData\Local\Temp\8D42.tmp"116⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\8D80.tmp"C:\Users\Admin\AppData\Local\Temp\8D80.tmp"117⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"C:\Users\Admin\AppData\Local\Temp\8DBF.tmp"118⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"C:\Users\Admin\AppData\Local\Temp\8DFD.tmp"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"C:\Users\Admin\AppData\Local\Temp\8E3B.tmp"120⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"C:\Users\Admin\AppData\Local\Temp\8E7A.tmp"121⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"122⤵PID:2660
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-