Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/10/2024, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe
-
Size
487KB
-
MD5
f12e631995a1ae80aac2e89cd8cfe24b
-
SHA1
6f3d14bd7178e15fd6c659d68186ea9937586a8e
-
SHA256
bab6914f5ed2a7e5aa57f91a02ecddb2785576bae7767e003823de5c59d1ae8b
-
SHA512
fe5cc86569a4224a625221f45397a59bb82d663b2b84882337d78f9f8103575834e17ef1c370808a885afa2c074949bf898c274a18785582d069cc584c885fcd
-
SSDEEP
12288:HU5rCOTeiJOeHkf5fewCCc5ik//yJlCkqyYXNZ:HUQOJJOeHNwCCcYk/cCNN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3024 A110.tmp 1244 A15E.tmp 2564 A1DB.tmp 2060 A257.tmp 2760 A2B5.tmp 2860 A322.tmp 2772 A370.tmp 2888 A3DD.tmp 2780 A43B.tmp 2640 A4A8.tmp 2664 A515.tmp 2632 A583.tmp 1676 A5E0.tmp 3060 A65D.tmp 1524 A6BB.tmp 320 A728.tmp 2064 A7A5.tmp 1124 A812.tmp 1980 A87F.tmp 592 A8EC.tmp 2028 A94A.tmp 1912 A9B7.tmp 2932 AA15.tmp 2604 AA53.tmp 576 AAA1.tmp 2388 AADF.tmp 560 AB1E.tmp 2488 AB5C.tmp 1748 AB9B.tmp 1604 ABD9.tmp 2840 AC17.tmp 444 AC56.tmp 3004 AC94.tmp 1036 ACD3.tmp 1332 AD11.tmp 1808 AD4F.tmp 324 AD8E.tmp 2956 ADCC.tmp 1600 AE0B.tmp 860 AE49.tmp 1800 AE87.tmp 1544 AEC6.tmp 2352 AF04.tmp 2284 AF43.tmp 1744 AF81.tmp 372 AFBF.tmp 2084 AFFE.tmp 912 B03C.tmp 1892 B06B.tmp 1896 B0A9.tmp 900 B0E8.tmp 2252 B126.tmp 2172 B165.tmp 1672 B1A3.tmp 3068 B1E1.tmp 3028 B220.tmp 1568 B25E.tmp 1376 B29D.tmp 2564 B2DB.tmp 2964 B329.tmp 2748 B377.tmp 2760 B3B5.tmp 2848 B3F4.tmp 2264 B442.tmp -
Loads dropped DLL 64 IoCs
pid Process 2696 2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe 3024 A110.tmp 1244 A15E.tmp 2564 A1DB.tmp 2060 A257.tmp 2760 A2B5.tmp 2860 A322.tmp 2772 A370.tmp 2888 A3DD.tmp 2780 A43B.tmp 2640 A4A8.tmp 2664 A515.tmp 2632 A583.tmp 1676 A5E0.tmp 3060 A65D.tmp 1524 A6BB.tmp 320 A728.tmp 2064 A7A5.tmp 1124 A812.tmp 1980 A87F.tmp 592 A8EC.tmp 2028 A94A.tmp 1912 A9B7.tmp 2932 AA15.tmp 2604 AA53.tmp 576 AAA1.tmp 2388 AADF.tmp 560 AB1E.tmp 2488 AB5C.tmp 1748 AB9B.tmp 1604 ABD9.tmp 2840 AC17.tmp 444 AC56.tmp 3004 AC94.tmp 1036 ACD3.tmp 1332 AD11.tmp 1808 AD4F.tmp 324 AD8E.tmp 2956 ADCC.tmp 1600 AE0B.tmp 860 AE49.tmp 1800 AE87.tmp 1544 AEC6.tmp 2352 AF04.tmp 2284 AF43.tmp 1744 AF81.tmp 372 AFBF.tmp 2084 AFFE.tmp 912 B03C.tmp 1892 B06B.tmp 1896 B0A9.tmp 900 B0E8.tmp 2252 B126.tmp 2172 B165.tmp 1672 B1A3.tmp 3068 B1E1.tmp 3028 B220.tmp 1568 B25E.tmp 1376 B29D.tmp 2564 B2DB.tmp 2964 B329.tmp 2748 B377.tmp 2760 B3B5.tmp 2848 B3F4.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F92E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FE3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3978.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C1D9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C255.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C7B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C477.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A322.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CEE3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C3E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6365.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E3E9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7BE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C83F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D153.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 694E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F122.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 204D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 619.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 80D3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3024 2696 2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe 30 PID 2696 wrote to memory of 3024 2696 2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe 30 PID 2696 wrote to memory of 3024 2696 2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe 30 PID 2696 wrote to memory of 3024 2696 2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe 30 PID 3024 wrote to memory of 1244 3024 A110.tmp 31 PID 3024 wrote to memory of 1244 3024 A110.tmp 31 PID 3024 wrote to memory of 1244 3024 A110.tmp 31 PID 3024 wrote to memory of 1244 3024 A110.tmp 31 PID 1244 wrote to memory of 2564 1244 A15E.tmp 32 PID 1244 wrote to memory of 2564 1244 A15E.tmp 32 PID 1244 wrote to memory of 2564 1244 A15E.tmp 32 PID 1244 wrote to memory of 2564 1244 A15E.tmp 32 PID 2564 wrote to memory of 2060 2564 A1DB.tmp 33 PID 2564 wrote to memory of 2060 2564 A1DB.tmp 33 PID 2564 wrote to memory of 2060 2564 A1DB.tmp 33 PID 2564 wrote to memory of 2060 2564 A1DB.tmp 33 PID 2060 wrote to memory of 2760 2060 A257.tmp 34 PID 2060 wrote to memory of 2760 2060 A257.tmp 34 PID 2060 wrote to memory of 2760 2060 A257.tmp 34 PID 2060 wrote to memory of 2760 2060 A257.tmp 34 PID 2760 wrote to memory of 2860 2760 A2B5.tmp 35 PID 2760 wrote to memory of 2860 2760 A2B5.tmp 35 PID 2760 wrote to memory of 2860 2760 A2B5.tmp 35 PID 2760 wrote to memory of 2860 2760 A2B5.tmp 35 PID 2860 wrote to memory of 2772 2860 A322.tmp 36 PID 2860 wrote to memory of 2772 2860 A322.tmp 36 PID 2860 wrote to memory of 2772 2860 A322.tmp 36 PID 2860 wrote to memory of 2772 2860 A322.tmp 36 PID 2772 wrote to memory of 2888 2772 A370.tmp 37 PID 2772 wrote to memory of 2888 2772 A370.tmp 37 PID 2772 wrote to memory of 2888 2772 A370.tmp 37 PID 2772 wrote to memory of 2888 2772 A370.tmp 37 PID 2888 wrote to memory of 2780 2888 A3DD.tmp 38 PID 2888 wrote to memory of 2780 2888 A3DD.tmp 38 PID 2888 wrote to memory of 2780 2888 A3DD.tmp 38 PID 2888 wrote to memory of 2780 2888 A3DD.tmp 38 PID 2780 wrote to memory of 2640 2780 A43B.tmp 39 PID 2780 wrote to memory of 2640 2780 A43B.tmp 39 PID 2780 wrote to memory of 2640 2780 A43B.tmp 39 PID 2780 wrote to memory of 2640 2780 A43B.tmp 39 PID 2640 wrote to memory of 2664 2640 A4A8.tmp 40 PID 2640 wrote to memory of 2664 2640 A4A8.tmp 40 PID 2640 wrote to memory of 2664 2640 A4A8.tmp 40 PID 2640 wrote to memory of 2664 2640 A4A8.tmp 40 PID 2664 wrote to memory of 2632 2664 A515.tmp 41 PID 2664 wrote to memory of 2632 2664 A515.tmp 41 PID 2664 wrote to memory of 2632 2664 A515.tmp 41 PID 2664 wrote to memory of 2632 2664 A515.tmp 41 PID 2632 wrote to memory of 1676 2632 A583.tmp 42 PID 2632 wrote to memory of 1676 2632 A583.tmp 42 PID 2632 wrote to memory of 1676 2632 A583.tmp 42 PID 2632 wrote to memory of 1676 2632 A583.tmp 42 PID 1676 wrote to memory of 3060 1676 A5E0.tmp 43 PID 1676 wrote to memory of 3060 1676 A5E0.tmp 43 PID 1676 wrote to memory of 3060 1676 A5E0.tmp 43 PID 1676 wrote to memory of 3060 1676 A5E0.tmp 43 PID 3060 wrote to memory of 1524 3060 A65D.tmp 44 PID 3060 wrote to memory of 1524 3060 A65D.tmp 44 PID 3060 wrote to memory of 1524 3060 A65D.tmp 44 PID 3060 wrote to memory of 1524 3060 A65D.tmp 44 PID 1524 wrote to memory of 320 1524 A6BB.tmp 45 PID 1524 wrote to memory of 320 1524 A6BB.tmp 45 PID 1524 wrote to memory of 320 1524 A6BB.tmp 45 PID 1524 wrote to memory of 320 1524 A6BB.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-06_f12e631995a1ae80aac2e89cd8cfe24b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A110.tmp"C:\Users\Admin\AppData\Local\Temp\A110.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\A15E.tmp"C:\Users\Admin\AppData\Local\Temp\A15E.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"C:\Users\Admin\AppData\Local\Temp\A1DB.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\A257.tmp"C:\Users\Admin\AppData\Local\Temp\A257.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"C:\Users\Admin\AppData\Local\Temp\A2B5.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\A322.tmp"C:\Users\Admin\AppData\Local\Temp\A322.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\A370.tmp"C:\Users\Admin\AppData\Local\Temp\A370.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"C:\Users\Admin\AppData\Local\Temp\A3DD.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\A43B.tmp"C:\Users\Admin\AppData\Local\Temp\A43B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"C:\Users\Admin\AppData\Local\Temp\A4A8.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\A515.tmp"C:\Users\Admin\AppData\Local\Temp\A515.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\A583.tmp"C:\Users\Admin\AppData\Local\Temp\A583.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"C:\Users\Admin\AppData\Local\Temp\A5E0.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\A65D.tmp"C:\Users\Admin\AppData\Local\Temp\A65D.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"C:\Users\Admin\AppData\Local\Temp\A6BB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\A728.tmp"C:\Users\Admin\AppData\Local\Temp\A728.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:320 -
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A812.tmp"C:\Users\Admin\AppData\Local\Temp\A812.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\A87F.tmp"C:\Users\Admin\AppData\Local\Temp\A87F.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"C:\Users\Admin\AppData\Local\Temp\A8EC.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\A94A.tmp"C:\Users\Admin\AppData\Local\Temp\A94A.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"C:\Users\Admin\AppData\Local\Temp\A9B7.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\AA15.tmp"C:\Users\Admin\AppData\Local\Temp\AA15.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\AA53.tmp"C:\Users\Admin\AppData\Local\Temp\AA53.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"C:\Users\Admin\AppData\Local\Temp\AAA1.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\AADF.tmp"C:\Users\Admin\AppData\Local\Temp\AADF.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"C:\Users\Admin\AppData\Local\Temp\AB1E.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"C:\Users\Admin\AppData\Local\Temp\AB5C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"C:\Users\Admin\AppData\Local\Temp\AB9B.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"C:\Users\Admin\AppData\Local\Temp\ABD9.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\AC17.tmp"C:\Users\Admin\AppData\Local\Temp\AC17.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:444 -
C:\Users\Admin\AppData\Local\Temp\AC94.tmp"C:\Users\Admin\AppData\Local\Temp\AC94.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"C:\Users\Admin\AppData\Local\Temp\ACD3.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\AD11.tmp"C:\Users\Admin\AppData\Local\Temp\AD11.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"C:\Users\Admin\AppData\Local\Temp\AD4F.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"C:\Users\Admin\AppData\Local\Temp\AD8E.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"C:\Users\Admin\AppData\Local\Temp\ADCC.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"C:\Users\Admin\AppData\Local\Temp\AE0B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\AE49.tmp"C:\Users\Admin\AppData\Local\Temp\AE49.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:860 -
C:\Users\Admin\AppData\Local\Temp\AE87.tmp"C:\Users\Admin\AppData\Local\Temp\AE87.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"C:\Users\Admin\AppData\Local\Temp\AEC6.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\AF04.tmp"C:\Users\Admin\AppData\Local\Temp\AF04.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\AF43.tmp"C:\Users\Admin\AppData\Local\Temp\AF43.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"C:\Users\Admin\AppData\Local\Temp\AFBF.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:372 -
C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"C:\Users\Admin\AppData\Local\Temp\AFFE.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\B03C.tmp"C:\Users\Admin\AppData\Local\Temp\B03C.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:912 -
C:\Users\Admin\AppData\Local\Temp\B06B.tmp"C:\Users\Admin\AppData\Local\Temp\B06B.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"C:\Users\Admin\AppData\Local\Temp\B0A9.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"C:\Users\Admin\AppData\Local\Temp\B0E8.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:900 -
C:\Users\Admin\AppData\Local\Temp\B126.tmp"C:\Users\Admin\AppData\Local\Temp\B126.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\B165.tmp"C:\Users\Admin\AppData\Local\Temp\B165.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"C:\Users\Admin\AppData\Local\Temp\B1A3.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"C:\Users\Admin\AppData\Local\Temp\B1E1.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\B220.tmp"C:\Users\Admin\AppData\Local\Temp\B220.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\B25E.tmp"C:\Users\Admin\AppData\Local\Temp\B25E.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\B29D.tmp"C:\Users\Admin\AppData\Local\Temp\B29D.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"C:\Users\Admin\AppData\Local\Temp\B2DB.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\B329.tmp"C:\Users\Admin\AppData\Local\Temp\B329.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\B377.tmp"C:\Users\Admin\AppData\Local\Temp\B377.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"C:\Users\Admin\AppData\Local\Temp\B3B5.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"C:\Users\Admin\AppData\Local\Temp\B3F4.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\B442.tmp"C:\Users\Admin\AppData\Local\Temp\B442.tmp"65⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\B480.tmp"C:\Users\Admin\AppData\Local\Temp\B480.tmp"66⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"C:\Users\Admin\AppData\Local\Temp\B4BF.tmp"67⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"C:\Users\Admin\AppData\Local\Temp\B4FD.tmp"68⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\B53B.tmp"C:\Users\Admin\AppData\Local\Temp\B53B.tmp"69⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\B57A.tmp"C:\Users\Admin\AppData\Local\Temp\B57A.tmp"70⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"C:\Users\Admin\AppData\Local\Temp\B5B8.tmp"71⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"C:\Users\Admin\AppData\Local\Temp\B5F7.tmp"72⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\B625.tmp"C:\Users\Admin\AppData\Local\Temp\B625.tmp"73⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\B664.tmp"C:\Users\Admin\AppData\Local\Temp\B664.tmp"74⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"C:\Users\Admin\AppData\Local\Temp\B6A2.tmp"75⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"C:\Users\Admin\AppData\Local\Temp\B6E1.tmp"76⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\B71F.tmp"C:\Users\Admin\AppData\Local\Temp\B71F.tmp"77⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\B75D.tmp"C:\Users\Admin\AppData\Local\Temp\B75D.tmp"78⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\B79C.tmp"C:\Users\Admin\AppData\Local\Temp\B79C.tmp"79⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"C:\Users\Admin\AppData\Local\Temp\B7DA.tmp"80⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\B828.tmp"C:\Users\Admin\AppData\Local\Temp\B828.tmp"81⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\B867.tmp"C:\Users\Admin\AppData\Local\Temp\B867.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"C:\Users\Admin\AppData\Local\Temp\B8A5.tmp"83⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"C:\Users\Admin\AppData\Local\Temp\B8E3.tmp"84⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\B922.tmp"C:\Users\Admin\AppData\Local\Temp\B922.tmp"85⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"86⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\B99F.tmp"C:\Users\Admin\AppData\Local\Temp\B99F.tmp"87⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"C:\Users\Admin\AppData\Local\Temp\B9DD.tmp"88⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"C:\Users\Admin\AppData\Local\Temp\BA1B.tmp"89⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"C:\Users\Admin\AppData\Local\Temp\BA5A.tmp"90⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"91⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"C:\Users\Admin\AppData\Local\Temp\BAD7.tmp"92⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\BB53.tmp"C:\Users\Admin\AppData\Local\Temp\BB53.tmp"94⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"95⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"C:\Users\Admin\AppData\Local\Temp\BBD0.tmp"96⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"C:\Users\Admin\AppData\Local\Temp\BC0F.tmp"97⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"C:\Users\Admin\AppData\Local\Temp\BC4D.tmp"98⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"99⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"C:\Users\Admin\AppData\Local\Temp\BCCA.tmp"100⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\BD08.tmp"C:\Users\Admin\AppData\Local\Temp\BD08.tmp"101⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\BD47.tmp"C:\Users\Admin\AppData\Local\Temp\BD47.tmp"102⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp"C:\Users\Admin\AppData\Local\Temp\BD85.tmp"103⤵PID:324
-
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"104⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\BE02.tmp"C:\Users\Admin\AppData\Local\Temp\BE02.tmp"105⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\BE40.tmp"C:\Users\Admin\AppData\Local\Temp\BE40.tmp"106⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"107⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"C:\Users\Admin\AppData\Local\Temp\BEBD.tmp"108⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"C:\Users\Admin\AppData\Local\Temp\BEFB.tmp"109⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"C:\Users\Admin\AppData\Local\Temp\BF2A.tmp"110⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\BF69.tmp"C:\Users\Admin\AppData\Local\Temp\BF69.tmp"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"C:\Users\Admin\AppData\Local\Temp\BFA7.tmp"112⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"C:\Users\Admin\AppData\Local\Temp\BFE5.tmp"113⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\C024.tmp"C:\Users\Admin\AppData\Local\Temp\C024.tmp"114⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"115⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"C:\Users\Admin\AppData\Local\Temp\C0A1.tmp"116⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"C:\Users\Admin\AppData\Local\Temp\C0DF.tmp"117⤵PID:900
-
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"118⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"120⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"C:\Users\Admin\AppData\Local\Temp\C1D9.tmp"121⤵
- System Location Discovery: System Language Discovery
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"122⤵PID:3028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-