Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
28/09/2024, 09:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe
-
Size
529KB
-
MD5
23ea4da0a176f01193ce284d87c3dff3
-
SHA1
e2a1e13a895ba7fe1ac1b7143b2a471fdea14a97
-
SHA256
96b584c628680b8be3b5b87092c6870869966c16b28439f3a6629f176bffd5b6
-
SHA512
d675193b3748bc907890ceb854c4ca89ef1af5fe2294a4c83f9de2c309844ea943925adf2b548899f7922d490c1b38f7f55eb66b86ec523403a93becf4b2a180
-
SSDEEP
12288:NU5rCOTeij18jm8jz+z1sNvVRcZKo+2TZwlH4Hp:NUQOJjTme0V6ZKo+2TSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2060 9B75.tmp 2528 9BE2.tmp 2340 9C6E.tmp 2212 9CEB.tmp 2736 9D49.tmp 2900 9DB6.tmp 2996 9E23.tmp 1932 9E90.tmp 2944 9EDE.tmp 2780 9F5B.tmp 2600 9FD8.tmp 2728 A055.tmp 2476 A0B2.tmp 1800 A11F.tmp 1020 A17D.tmp 2592 A1EA.tmp 480 A248.tmp 1992 A2C5.tmp 2016 A322.tmp 2512 A38F.tmp 2164 A3ED.tmp 1640 A479.tmp 3068 A4C7.tmp 2964 A506.tmp 1936 A544.tmp 2124 A583.tmp 872 A5C1.tmp 2112 A5FF.tmp 2792 A63E.tmp 3064 A67C.tmp 1136 A6BB.tmp 2584 A6F9.tmp 2044 A737.tmp 544 A776.tmp 1996 A7B4.tmp 2644 A7F3.tmp 2576 A831.tmp 844 A86F.tmp 1240 A8AE.tmp 2368 A8EC.tmp 908 A92B.tmp 2492 A979.tmp 3000 A9B7.tmp 2104 A9F5.tmp 1588 AA34.tmp 2436 AA72.tmp 1668 AAB1.tmp 1792 AAEF.tmp 1680 AB2D.tmp 1516 AB6C.tmp 1412 ABAA.tmp 2168 ABE9.tmp 1604 AC27.tmp 772 AC65.tmp 1972 ACA4.tmp 2528 ACE2.tmp 1672 AD21.tmp 2328 AD5F.tmp 2260 AD9D.tmp 2868 ADDC.tmp 2880 AE1A.tmp 2908 AE59.tmp 2904 AEA7.tmp 2768 AEE5.tmp -
Loads dropped DLL 64 IoCs
pid Process 3048 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 2060 9B75.tmp 2528 9BE2.tmp 2340 9C6E.tmp 2212 9CEB.tmp 2736 9D49.tmp 2900 9DB6.tmp 2996 9E23.tmp 1932 9E90.tmp 2944 9EDE.tmp 2780 9F5B.tmp 2600 9FD8.tmp 2728 A055.tmp 2476 A0B2.tmp 1800 A11F.tmp 1020 A17D.tmp 2592 A1EA.tmp 480 A248.tmp 1992 A2C5.tmp 2016 A322.tmp 2512 A38F.tmp 2164 A3ED.tmp 1640 A479.tmp 3068 A4C7.tmp 2964 A506.tmp 1936 A544.tmp 2124 A583.tmp 872 A5C1.tmp 2112 A5FF.tmp 2792 A63E.tmp 3064 A67C.tmp 1136 A6BB.tmp 2584 A6F9.tmp 2044 A737.tmp 544 A776.tmp 1996 A7B4.tmp 2644 A7F3.tmp 2576 A831.tmp 844 A86F.tmp 1240 A8AE.tmp 2368 A8EC.tmp 908 A92B.tmp 2492 A979.tmp 3000 A9B7.tmp 2104 A9F5.tmp 1588 AA34.tmp 2436 AA72.tmp 1668 AAB1.tmp 1792 AAEF.tmp 1680 AB2D.tmp 1516 AB6C.tmp 1412 ABAA.tmp 2168 ABE9.tmp 1604 AC27.tmp 772 AC65.tmp 1972 ACA4.tmp 2528 ACE2.tmp 1672 AD21.tmp 2328 AD5F.tmp 2260 AD9D.tmp 2868 ADDC.tmp 2880 AE1A.tmp 2908 AE59.tmp 2904 AEA7.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 85F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F6DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D27B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9444.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9B7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C938.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5E75.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DDC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 476C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A1EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 361E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C552.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD1F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7EC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D3B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CB7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 405A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3048 wrote to memory of 2060 3048 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 30 PID 3048 wrote to memory of 2060 3048 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 30 PID 3048 wrote to memory of 2060 3048 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 30 PID 3048 wrote to memory of 2060 3048 2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe 30 PID 2060 wrote to memory of 2528 2060 9B75.tmp 31 PID 2060 wrote to memory of 2528 2060 9B75.tmp 31 PID 2060 wrote to memory of 2528 2060 9B75.tmp 31 PID 2060 wrote to memory of 2528 2060 9B75.tmp 31 PID 2528 wrote to memory of 2340 2528 9BE2.tmp 32 PID 2528 wrote to memory of 2340 2528 9BE2.tmp 32 PID 2528 wrote to memory of 2340 2528 9BE2.tmp 32 PID 2528 wrote to memory of 2340 2528 9BE2.tmp 32 PID 2340 wrote to memory of 2212 2340 9C6E.tmp 33 PID 2340 wrote to memory of 2212 2340 9C6E.tmp 33 PID 2340 wrote to memory of 2212 2340 9C6E.tmp 33 PID 2340 wrote to memory of 2212 2340 9C6E.tmp 33 PID 2212 wrote to memory of 2736 2212 9CEB.tmp 34 PID 2212 wrote to memory of 2736 2212 9CEB.tmp 34 PID 2212 wrote to memory of 2736 2212 9CEB.tmp 34 PID 2212 wrote to memory of 2736 2212 9CEB.tmp 34 PID 2736 wrote to memory of 2900 2736 9D49.tmp 35 PID 2736 wrote to memory of 2900 2736 9D49.tmp 35 PID 2736 wrote to memory of 2900 2736 9D49.tmp 35 PID 2736 wrote to memory of 2900 2736 9D49.tmp 35 PID 2900 wrote to memory of 2996 2900 9DB6.tmp 36 PID 2900 wrote to memory of 2996 2900 9DB6.tmp 36 PID 2900 wrote to memory of 2996 2900 9DB6.tmp 36 PID 2900 wrote to memory of 2996 2900 9DB6.tmp 36 PID 2996 wrote to memory of 1932 2996 9E23.tmp 37 PID 2996 wrote to memory of 1932 2996 9E23.tmp 37 PID 2996 wrote to memory of 1932 2996 9E23.tmp 37 PID 2996 wrote to memory of 1932 2996 9E23.tmp 37 PID 1932 wrote to memory of 2944 1932 9E90.tmp 38 PID 1932 wrote to memory of 2944 1932 9E90.tmp 38 PID 1932 wrote to memory of 2944 1932 9E90.tmp 38 PID 1932 wrote to memory of 2944 1932 9E90.tmp 38 PID 2944 wrote to memory of 2780 2944 9EDE.tmp 39 PID 2944 wrote to memory of 2780 2944 9EDE.tmp 39 PID 2944 wrote to memory of 2780 2944 9EDE.tmp 39 PID 2944 wrote to memory of 2780 2944 9EDE.tmp 39 PID 2780 wrote to memory of 2600 2780 9F5B.tmp 40 PID 2780 wrote to memory of 2600 2780 9F5B.tmp 40 PID 2780 wrote to memory of 2600 2780 9F5B.tmp 40 PID 2780 wrote to memory of 2600 2780 9F5B.tmp 40 PID 2600 wrote to memory of 2728 2600 9FD8.tmp 41 PID 2600 wrote to memory of 2728 2600 9FD8.tmp 41 PID 2600 wrote to memory of 2728 2600 9FD8.tmp 41 PID 2600 wrote to memory of 2728 2600 9FD8.tmp 41 PID 2728 wrote to memory of 2476 2728 A055.tmp 42 PID 2728 wrote to memory of 2476 2728 A055.tmp 42 PID 2728 wrote to memory of 2476 2728 A055.tmp 42 PID 2728 wrote to memory of 2476 2728 A055.tmp 42 PID 2476 wrote to memory of 1800 2476 A0B2.tmp 43 PID 2476 wrote to memory of 1800 2476 A0B2.tmp 43 PID 2476 wrote to memory of 1800 2476 A0B2.tmp 43 PID 2476 wrote to memory of 1800 2476 A0B2.tmp 43 PID 1800 wrote to memory of 1020 1800 A11F.tmp 44 PID 1800 wrote to memory of 1020 1800 A11F.tmp 44 PID 1800 wrote to memory of 1020 1800 A11F.tmp 44 PID 1800 wrote to memory of 1020 1800 A11F.tmp 44 PID 1020 wrote to memory of 2592 1020 A17D.tmp 45 PID 1020 wrote to memory of 2592 1020 A17D.tmp 45 PID 1020 wrote to memory of 2592 1020 A17D.tmp 45 PID 1020 wrote to memory of 2592 1020 A17D.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_23ea4da0a176f01193ce284d87c3dff3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"C:\Users\Admin\AppData\Local\Temp\9C6E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"C:\Users\Admin\AppData\Local\Temp\9CEB.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"C:\Users\Admin\AppData\Local\Temp\9DB6.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\9E23.tmp"C:\Users\Admin\AppData\Local\Temp\9E23.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\9E90.tmp"C:\Users\Admin\AppData\Local\Temp\9E90.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"C:\Users\Admin\AppData\Local\Temp\9EDE.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"C:\Users\Admin\AppData\Local\Temp\9F5B.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"C:\Users\Admin\AppData\Local\Temp\9FD8.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\A055.tmp"C:\Users\Admin\AppData\Local\Temp\A055.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"C:\Users\Admin\AppData\Local\Temp\A0B2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\A11F.tmp"C:\Users\Admin\AppData\Local\Temp\A11F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\A17D.tmp"C:\Users\Admin\AppData\Local\Temp\A17D.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"C:\Users\Admin\AppData\Local\Temp\A1EA.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\A248.tmp"C:\Users\Admin\AppData\Local\Temp\A248.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:480 -
C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"C:\Users\Admin\AppData\Local\Temp\A2C5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\A38F.tmp"C:\Users\Admin\AppData\Local\Temp\A38F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"C:\Users\Admin\AppData\Local\Temp\A3ED.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\A479.tmp"C:\Users\Admin\AppData\Local\Temp\A479.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"C:\Users\Admin\AppData\Local\Temp\A4C7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\A506.tmp"C:\Users\Admin\AppData\Local\Temp\A506.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\A544.tmp"C:\Users\Admin\AppData\Local\Temp\A544.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"C:\Users\Admin\AppData\Local\Temp\A5C1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:872 -
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\A63E.tmp"C:\Users\Admin\AppData\Local\Temp\A63E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\A67C.tmp"C:\Users\Admin\AppData\Local\Temp\A67C.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\A737.tmp"C:\Users\Admin\AppData\Local\Temp\A737.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\A776.tmp"C:\Users\Admin\AppData\Local\Temp\A776.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"C:\Users\Admin\AppData\Local\Temp\A7B4.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"C:\Users\Admin\AppData\Local\Temp\A7F3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\A831.tmp"C:\Users\Admin\AppData\Local\Temp\A831.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\A86F.tmp"C:\Users\Admin\AppData\Local\Temp\A86F.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"C:\Users\Admin\AppData\Local\Temp\A8AE.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\A92B.tmp"C:\Users\Admin\AppData\Local\Temp\A92B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\A979.tmp"C:\Users\Admin\AppData\Local\Temp\A979.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"C:\Users\Admin\AppData\Local\Temp\A9F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\AA34.tmp"C:\Users\Admin\AppData\Local\Temp\AA34.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\AA72.tmp"C:\Users\Admin\AppData\Local\Temp\AA72.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"C:\Users\Admin\AppData\Local\Temp\AAB1.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"C:\Users\Admin\AppData\Local\Temp\AAEF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"C:\Users\Admin\AppData\Local\Temp\AB2D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"C:\Users\Admin\AppData\Local\Temp\AB6C.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"C:\Users\Admin\AppData\Local\Temp\ABAA.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"C:\Users\Admin\AppData\Local\Temp\ABE9.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\AC27.tmp"C:\Users\Admin\AppData\Local\Temp\AC27.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\AC65.tmp"C:\Users\Admin\AppData\Local\Temp\AC65.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"C:\Users\Admin\AppData\Local\Temp\ACA4.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"C:\Users\Admin\AppData\Local\Temp\ACE2.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\AD21.tmp"C:\Users\Admin\AppData\Local\Temp\AD21.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"C:\Users\Admin\AppData\Local\Temp\AD5F.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"C:\Users\Admin\AppData\Local\Temp\AD9D.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"C:\Users\Admin\AppData\Local\Temp\ADDC.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"C:\Users\Admin\AppData\Local\Temp\AE1A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\AE59.tmp"C:\Users\Admin\AppData\Local\Temp\AE59.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"C:\Users\Admin\AppData\Local\Temp\AEA7.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"C:\Users\Admin\AppData\Local\Temp\AEE5.tmp"65⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\AF23.tmp"C:\Users\Admin\AppData\Local\Temp\AF23.tmp"66⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\AF52.tmp"C:\Users\Admin\AppData\Local\Temp\AF52.tmp"67⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\AF91.tmp"C:\Users\Admin\AppData\Local\Temp\AF91.tmp"68⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"C:\Users\Admin\AppData\Local\Temp\AFCF.tmp"69⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\B00D.tmp"C:\Users\Admin\AppData\Local\Temp\B00D.tmp"70⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\B04C.tmp"C:\Users\Admin\AppData\Local\Temp\B04C.tmp"71⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\B08A.tmp"C:\Users\Admin\AppData\Local\Temp\B08A.tmp"72⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"C:\Users\Admin\AppData\Local\Temp\B0C9.tmp"73⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B107.tmp"C:\Users\Admin\AppData\Local\Temp\B107.tmp"74⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B145.tmp"C:\Users\Admin\AppData\Local\Temp\B145.tmp"75⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\B184.tmp"C:\Users\Admin\AppData\Local\Temp\B184.tmp"76⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"C:\Users\Admin\AppData\Local\Temp\B1C2.tmp"77⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\B201.tmp"C:\Users\Admin\AppData\Local\Temp\B201.tmp"78⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\B23F.tmp"C:\Users\Admin\AppData\Local\Temp\B23F.tmp"79⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\B27D.tmp"C:\Users\Admin\AppData\Local\Temp\B27D.tmp"80⤵PID:480
-
C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"C:\Users\Admin\AppData\Local\Temp\B2BC.tmp"81⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"C:\Users\Admin\AppData\Local\Temp\B2FA.tmp"82⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B339.tmp"C:\Users\Admin\AppData\Local\Temp\B339.tmp"83⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"84⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"85⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"86⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\B432.tmp"C:\Users\Admin\AppData\Local\Temp\B432.tmp"87⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\B471.tmp"C:\Users\Admin\AppData\Local\Temp\B471.tmp"88⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"C:\Users\Admin\AppData\Local\Temp\B4AF.tmp"89⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"C:\Users\Admin\AppData\Local\Temp\B4ED.tmp"90⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\B52C.tmp"C:\Users\Admin\AppData\Local\Temp\B52C.tmp"91⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\B56A.tmp"C:\Users\Admin\AppData\Local\Temp\B56A.tmp"92⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"C:\Users\Admin\AppData\Local\Temp\B5A9.tmp"93⤵PID:2256
-
C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"C:\Users\Admin\AppData\Local\Temp\B5E7.tmp"94⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"96⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"97⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"98⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"99⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"100⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"101⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"102⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\B819.tmp"C:\Users\Admin\AppData\Local\Temp\B819.tmp"103⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\B857.tmp"C:\Users\Admin\AppData\Local\Temp\B857.tmp"104⤵PID:1240
-
C:\Users\Admin\AppData\Local\Temp\B895.tmp"C:\Users\Admin\AppData\Local\Temp\B895.tmp"105⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"C:\Users\Admin\AppData\Local\Temp\B8D4.tmp"106⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\B912.tmp"C:\Users\Admin\AppData\Local\Temp\B912.tmp"107⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\B951.tmp"C:\Users\Admin\AppData\Local\Temp\B951.tmp"108⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\B98F.tmp"C:\Users\Admin\AppData\Local\Temp\B98F.tmp"109⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"C:\Users\Admin\AppData\Local\Temp\B9CD.tmp"110⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"C:\Users\Admin\AppData\Local\Temp\BA0C.tmp"111⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"C:\Users\Admin\AppData\Local\Temp\BA4A.tmp"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\BA79.tmp"C:\Users\Admin\AppData\Local\Temp\BA79.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"C:\Users\Admin\AppData\Local\Temp\BAB7.tmp"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"C:\Users\Admin\AppData\Local\Temp\BAF6.tmp"115⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\BB34.tmp"C:\Users\Admin\AppData\Local\Temp\BB34.tmp"116⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\BB73.tmp"C:\Users\Admin\AppData\Local\Temp\BB73.tmp"117⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"C:\Users\Admin\AppData\Local\Temp\BBB1.tmp"118⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"C:\Users\Admin\AppData\Local\Temp\BBEF.tmp"119⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"C:\Users\Admin\AppData\Local\Temp\BC2E.tmp"120⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"C:\Users\Admin\AppData\Local\Temp\BC6C.tmp"121⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"C:\Users\Admin\AppData\Local\Temp\BCAB.tmp"122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-