Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
12/10/2024, 04:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe
-
Size
487KB
-
MD5
add6eea3d279d0b964b9ac1f49f03dea
-
SHA1
73eddda7d4e738422b73ebda50a3a643667d6e1a
-
SHA256
9cbe186323922e514795d814a8f5c5c190bcc70faada5e3ac5327fd2dcd7a1ca
-
SHA512
303733b9665ced2b32e723c7db427b0eeb28503ad8f8d8195e5a4463c8619d9f8421ba411bdbd9df4290ef1007de0c8a496dbe68bee4eac5f138631a0ba4c631
-
SSDEEP
12288:HU5rCOTeiJ8+3F9/eutqUo5mFvlpgglw+lqK4Vq5NZ:HUQOJJ8ZuYUkM92+lX4yN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2380 783C.tmp 2748 788A.tmp 2904 7907.tmp 2824 7974.tmp 2228 79D1.tmp 2968 7A3F.tmp 2768 7A9C.tmp 2600 7AFA.tmp 2672 7B67.tmp 2652 7BB5.tmp 1804 7C13.tmp 352 7C70.tmp 2128 7CCE.tmp 1032 7D2B.tmp 2892 7D99.tmp 1068 7DF6.tmp 2992 7E63.tmp 1052 7ED1.tmp 396 7F4D.tmp 1108 7FBB.tmp 2004 8018.tmp 592 8085.tmp 476 80D3.tmp 584 8112.tmp 2816 8150.tmp 2220 819E.tmp 2460 81EC.tmp 1628 822B.tmp 1828 8269.tmp 2096 82A7.tmp 804 82F5.tmp 2280 8334.tmp 1280 8372.tmp 1608 83B1.tmp 1488 83FF.tmp 1676 843D.tmp 836 847B.tmp 1544 84BA.tmp 956 84F8.tmp 1632 8556.tmp 2320 8594.tmp 1720 85E2.tmp 1960 8630.tmp 2388 867E.tmp 1772 86BD.tmp 2216 86FB.tmp 1948 8749.tmp 1736 8797.tmp 2400 87D5.tmp 892 8823.tmp 2072 8862.tmp 2692 88B0.tmp 1596 88EE.tmp 2784 892D.tmp 2712 896B.tmp 2792 89B9.tmp 2732 89F7.tmp 2908 8A36.tmp 2752 8A74.tmp 2608 8AC2.tmp 2852 8B01.tmp 2944 8B5E.tmp 2628 8B9D.tmp 2920 8BEB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2936 2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe 2380 783C.tmp 2748 788A.tmp 2904 7907.tmp 2824 7974.tmp 2228 79D1.tmp 2968 7A3F.tmp 2768 7A9C.tmp 2600 7AFA.tmp 2672 7B67.tmp 2652 7BB5.tmp 1804 7C13.tmp 352 7C70.tmp 2128 7CCE.tmp 1032 7D2B.tmp 2892 7D99.tmp 1068 7DF6.tmp 2992 7E63.tmp 1052 7ED1.tmp 396 7F4D.tmp 1108 7FBB.tmp 2004 8018.tmp 592 8085.tmp 476 80D3.tmp 584 8112.tmp 2816 8150.tmp 2220 819E.tmp 2460 81EC.tmp 1628 822B.tmp 1828 8269.tmp 2096 82A7.tmp 804 82F5.tmp 2280 8334.tmp 1280 8372.tmp 1608 83B1.tmp 1488 83FF.tmp 1676 843D.tmp 836 847B.tmp 1544 84BA.tmp 956 84F8.tmp 1632 8556.tmp 2320 8594.tmp 1720 85E2.tmp 1960 8630.tmp 2388 867E.tmp 1772 86BD.tmp 2216 86FB.tmp 1948 8749.tmp 1736 8797.tmp 2400 87D5.tmp 892 8823.tmp 2072 8862.tmp 2692 88B0.tmp 1596 88EE.tmp 2784 892D.tmp 2712 896B.tmp 2792 89B9.tmp 2732 89F7.tmp 2908 8A36.tmp 2752 8A74.tmp 2608 8AC2.tmp 2852 8B01.tmp 2944 8B5E.tmp 2628 8B9D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EE16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FBFB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2617.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5909.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ED5B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8334.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8862.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46B1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB79.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEB9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 426.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2D4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 42CA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EB8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A86F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1CF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1268.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E37C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AE2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E9E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8556.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5551.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 58CA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2380 2936 2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe 30 PID 2936 wrote to memory of 2380 2936 2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe 30 PID 2936 wrote to memory of 2380 2936 2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe 30 PID 2936 wrote to memory of 2380 2936 2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe 30 PID 2380 wrote to memory of 2748 2380 783C.tmp 31 PID 2380 wrote to memory of 2748 2380 783C.tmp 31 PID 2380 wrote to memory of 2748 2380 783C.tmp 31 PID 2380 wrote to memory of 2748 2380 783C.tmp 31 PID 2748 wrote to memory of 2904 2748 788A.tmp 32 PID 2748 wrote to memory of 2904 2748 788A.tmp 32 PID 2748 wrote to memory of 2904 2748 788A.tmp 32 PID 2748 wrote to memory of 2904 2748 788A.tmp 32 PID 2904 wrote to memory of 2824 2904 7907.tmp 33 PID 2904 wrote to memory of 2824 2904 7907.tmp 33 PID 2904 wrote to memory of 2824 2904 7907.tmp 33 PID 2904 wrote to memory of 2824 2904 7907.tmp 33 PID 2824 wrote to memory of 2228 2824 7974.tmp 34 PID 2824 wrote to memory of 2228 2824 7974.tmp 34 PID 2824 wrote to memory of 2228 2824 7974.tmp 34 PID 2824 wrote to memory of 2228 2824 7974.tmp 34 PID 2228 wrote to memory of 2968 2228 79D1.tmp 35 PID 2228 wrote to memory of 2968 2228 79D1.tmp 35 PID 2228 wrote to memory of 2968 2228 79D1.tmp 35 PID 2228 wrote to memory of 2968 2228 79D1.tmp 35 PID 2968 wrote to memory of 2768 2968 7A3F.tmp 36 PID 2968 wrote to memory of 2768 2968 7A3F.tmp 36 PID 2968 wrote to memory of 2768 2968 7A3F.tmp 36 PID 2968 wrote to memory of 2768 2968 7A3F.tmp 36 PID 2768 wrote to memory of 2600 2768 7A9C.tmp 37 PID 2768 wrote to memory of 2600 2768 7A9C.tmp 37 PID 2768 wrote to memory of 2600 2768 7A9C.tmp 37 PID 2768 wrote to memory of 2600 2768 7A9C.tmp 37 PID 2600 wrote to memory of 2672 2600 7AFA.tmp 38 PID 2600 wrote to memory of 2672 2600 7AFA.tmp 38 PID 2600 wrote to memory of 2672 2600 7AFA.tmp 38 PID 2600 wrote to memory of 2672 2600 7AFA.tmp 38 PID 2672 wrote to memory of 2652 2672 7B67.tmp 39 PID 2672 wrote to memory of 2652 2672 7B67.tmp 39 PID 2672 wrote to memory of 2652 2672 7B67.tmp 39 PID 2672 wrote to memory of 2652 2672 7B67.tmp 39 PID 2652 wrote to memory of 1804 2652 7BB5.tmp 40 PID 2652 wrote to memory of 1804 2652 7BB5.tmp 40 PID 2652 wrote to memory of 1804 2652 7BB5.tmp 40 PID 2652 wrote to memory of 1804 2652 7BB5.tmp 40 PID 1804 wrote to memory of 352 1804 7C13.tmp 41 PID 1804 wrote to memory of 352 1804 7C13.tmp 41 PID 1804 wrote to memory of 352 1804 7C13.tmp 41 PID 1804 wrote to memory of 352 1804 7C13.tmp 41 PID 352 wrote to memory of 2128 352 7C70.tmp 42 PID 352 wrote to memory of 2128 352 7C70.tmp 42 PID 352 wrote to memory of 2128 352 7C70.tmp 42 PID 352 wrote to memory of 2128 352 7C70.tmp 42 PID 2128 wrote to memory of 1032 2128 7CCE.tmp 43 PID 2128 wrote to memory of 1032 2128 7CCE.tmp 43 PID 2128 wrote to memory of 1032 2128 7CCE.tmp 43 PID 2128 wrote to memory of 1032 2128 7CCE.tmp 43 PID 1032 wrote to memory of 2892 1032 7D2B.tmp 44 PID 1032 wrote to memory of 2892 1032 7D2B.tmp 44 PID 1032 wrote to memory of 2892 1032 7D2B.tmp 44 PID 1032 wrote to memory of 2892 1032 7D2B.tmp 44 PID 2892 wrote to memory of 1068 2892 7D99.tmp 45 PID 2892 wrote to memory of 1068 2892 7D99.tmp 45 PID 2892 wrote to memory of 1068 2892 7D99.tmp 45 PID 2892 wrote to memory of 1068 2892 7D99.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-12_add6eea3d279d0b964b9ac1f49f03dea_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\783C.tmp"C:\Users\Admin\AppData\Local\Temp\783C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\788A.tmp"C:\Users\Admin\AppData\Local\Temp\788A.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\7907.tmp"C:\Users\Admin\AppData\Local\Temp\7907.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\7974.tmp"C:\Users\Admin\AppData\Local\Temp\7974.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\79D1.tmp"C:\Users\Admin\AppData\Local\Temp\79D1.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"C:\Users\Admin\AppData\Local\Temp\7A3F.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"C:\Users\Admin\AppData\Local\Temp\7A9C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"C:\Users\Admin\AppData\Local\Temp\7AFA.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"C:\Users\Admin\AppData\Local\Temp\7BB5.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\7C13.tmp"C:\Users\Admin\AppData\Local\Temp\7C13.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\7C70.tmp"C:\Users\Admin\AppData\Local\Temp\7C70.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:352 -
C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"C:\Users\Admin\AppData\Local\Temp\7CCE.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"C:\Users\Admin\AppData\Local\Temp\7D2B.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\7D99.tmp"C:\Users\Admin\AppData\Local\Temp\7D99.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"C:\Users\Admin\AppData\Local\Temp\7DF6.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\7E63.tmp"C:\Users\Admin\AppData\Local\Temp\7E63.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"C:\Users\Admin\AppData\Local\Temp\7ED1.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"C:\Users\Admin\AppData\Local\Temp\7F4D.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:396 -
C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"C:\Users\Admin\AppData\Local\Temp\7FBB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8085.tmp"C:\Users\Admin\AppData\Local\Temp\8085.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:592 -
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:476 -
C:\Users\Admin\AppData\Local\Temp\8112.tmp"C:\Users\Admin\AppData\Local\Temp\8112.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\819E.tmp"C:\Users\Admin\AppData\Local\Temp\819E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\81EC.tmp"C:\Users\Admin\AppData\Local\Temp\81EC.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\822B.tmp"C:\Users\Admin\AppData\Local\Temp\822B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\8269.tmp"C:\Users\Admin\AppData\Local\Temp\8269.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\82A7.tmp"C:\Users\Admin\AppData\Local\Temp\82A7.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\82F5.tmp"C:\Users\Admin\AppData\Local\Temp\82F5.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:804 -
C:\Users\Admin\AppData\Local\Temp\8334.tmp"C:\Users\Admin\AppData\Local\Temp\8334.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\8372.tmp"C:\Users\Admin\AppData\Local\Temp\8372.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\83B1.tmp"C:\Users\Admin\AppData\Local\Temp\83B1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\83FF.tmp"C:\Users\Admin\AppData\Local\Temp\83FF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\843D.tmp"C:\Users\Admin\AppData\Local\Temp\843D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\847B.tmp"C:\Users\Admin\AppData\Local\Temp\847B.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\84BA.tmp"C:\Users\Admin\AppData\Local\Temp\84BA.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\84F8.tmp"C:\Users\Admin\AppData\Local\Temp\84F8.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956 -
C:\Users\Admin\AppData\Local\Temp\8556.tmp"C:\Users\Admin\AppData\Local\Temp\8556.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\8594.tmp"C:\Users\Admin\AppData\Local\Temp\8594.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\85E2.tmp"C:\Users\Admin\AppData\Local\Temp\85E2.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\8630.tmp"C:\Users\Admin\AppData\Local\Temp\8630.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\867E.tmp"C:\Users\Admin\AppData\Local\Temp\867E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\86BD.tmp"C:\Users\Admin\AppData\Local\Temp\86BD.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\86FB.tmp"C:\Users\Admin\AppData\Local\Temp\86FB.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\8749.tmp"C:\Users\Admin\AppData\Local\Temp\8749.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\8797.tmp"C:\Users\Admin\AppData\Local\Temp\8797.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\87D5.tmp"C:\Users\Admin\AppData\Local\Temp\87D5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\8823.tmp"C:\Users\Admin\AppData\Local\Temp\8823.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\8862.tmp"C:\Users\Admin\AppData\Local\Temp\8862.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\88B0.tmp"C:\Users\Admin\AppData\Local\Temp\88B0.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\88EE.tmp"C:\Users\Admin\AppData\Local\Temp\88EE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\892D.tmp"C:\Users\Admin\AppData\Local\Temp\892D.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\896B.tmp"C:\Users\Admin\AppData\Local\Temp\896B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\89B9.tmp"C:\Users\Admin\AppData\Local\Temp\89B9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\89F7.tmp"C:\Users\Admin\AppData\Local\Temp\89F7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\8A36.tmp"C:\Users\Admin\AppData\Local\Temp\8A36.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\8A74.tmp"C:\Users\Admin\AppData\Local\Temp\8A74.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"C:\Users\Admin\AppData\Local\Temp\8AC2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\8B01.tmp"C:\Users\Admin\AppData\Local\Temp\8B01.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"C:\Users\Admin\AppData\Local\Temp\8B5E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"C:\Users\Admin\AppData\Local\Temp\8B9D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"C:\Users\Admin\AppData\Local\Temp\8BEB.tmp"65⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\8C58.tmp"C:\Users\Admin\AppData\Local\Temp\8C58.tmp"66⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\8C96.tmp"C:\Users\Admin\AppData\Local\Temp\8C96.tmp"67⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"C:\Users\Admin\AppData\Local\Temp\8CD5.tmp"68⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\8D23.tmp"C:\Users\Admin\AppData\Local\Temp\8D23.tmp"69⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\8D61.tmp"C:\Users\Admin\AppData\Local\Temp\8D61.tmp"70⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"C:\Users\Admin\AppData\Local\Temp\8DAF.tmp"71⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\8DED.tmp"C:\Users\Admin\AppData\Local\Temp\8DED.tmp"72⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"C:\Users\Admin\AppData\Local\Temp\8E2C.tmp"73⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"C:\Users\Admin\AppData\Local\Temp\8E6A.tmp"74⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"C:\Users\Admin\AppData\Local\Temp\8EB8.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"C:\Users\Admin\AppData\Local\Temp\8EF7.tmp"76⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\8F35.tmp"C:\Users\Admin\AppData\Local\Temp\8F35.tmp"77⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\8F83.tmp"C:\Users\Admin\AppData\Local\Temp\8F83.tmp"78⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"C:\Users\Admin\AppData\Local\Temp\8FD1.tmp"79⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\900F.tmp"C:\Users\Admin\AppData\Local\Temp\900F.tmp"80⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\905D.tmp"C:\Users\Admin\AppData\Local\Temp\905D.tmp"81⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\909C.tmp"C:\Users\Admin\AppData\Local\Temp\909C.tmp"82⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\90DA.tmp"C:\Users\Admin\AppData\Local\Temp\90DA.tmp"83⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\9119.tmp"C:\Users\Admin\AppData\Local\Temp\9119.tmp"84⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\9157.tmp"C:\Users\Admin\AppData\Local\Temp\9157.tmp"85⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\9195.tmp"C:\Users\Admin\AppData\Local\Temp\9195.tmp"86⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\91E3.tmp"C:\Users\Admin\AppData\Local\Temp\91E3.tmp"87⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\9222.tmp"C:\Users\Admin\AppData\Local\Temp\9222.tmp"88⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\9260.tmp"C:\Users\Admin\AppData\Local\Temp\9260.tmp"89⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\929F.tmp"C:\Users\Admin\AppData\Local\Temp\929F.tmp"90⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\92DD.tmp"C:\Users\Admin\AppData\Local\Temp\92DD.tmp"91⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\931B.tmp"C:\Users\Admin\AppData\Local\Temp\931B.tmp"92⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\935A.tmp"C:\Users\Admin\AppData\Local\Temp\935A.tmp"93⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\9398.tmp"C:\Users\Admin\AppData\Local\Temp\9398.tmp"94⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\93E6.tmp"C:\Users\Admin\AppData\Local\Temp\93E6.tmp"95⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\9425.tmp"C:\Users\Admin\AppData\Local\Temp\9425.tmp"96⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\9463.tmp"C:\Users\Admin\AppData\Local\Temp\9463.tmp"97⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\94A1.tmp"C:\Users\Admin\AppData\Local\Temp\94A1.tmp"98⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\94E0.tmp"C:\Users\Admin\AppData\Local\Temp\94E0.tmp"99⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\951E.tmp"C:\Users\Admin\AppData\Local\Temp\951E.tmp"100⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\955D.tmp"C:\Users\Admin\AppData\Local\Temp\955D.tmp"101⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\959B.tmp"C:\Users\Admin\AppData\Local\Temp\959B.tmp"102⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\95D9.tmp"C:\Users\Admin\AppData\Local\Temp\95D9.tmp"103⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\9618.tmp"C:\Users\Admin\AppData\Local\Temp\9618.tmp"104⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\9656.tmp"C:\Users\Admin\AppData\Local\Temp\9656.tmp"105⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\9695.tmp"C:\Users\Admin\AppData\Local\Temp\9695.tmp"106⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\96E3.tmp"C:\Users\Admin\AppData\Local\Temp\96E3.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:316 -
C:\Users\Admin\AppData\Local\Temp\9721.tmp"C:\Users\Admin\AppData\Local\Temp\9721.tmp"108⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\975F.tmp"C:\Users\Admin\AppData\Local\Temp\975F.tmp"109⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\979E.tmp"C:\Users\Admin\AppData\Local\Temp\979E.tmp"110⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\97DC.tmp"C:\Users\Admin\AppData\Local\Temp\97DC.tmp"111⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\981B.tmp"C:\Users\Admin\AppData\Local\Temp\981B.tmp"112⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\9859.tmp"C:\Users\Admin\AppData\Local\Temp\9859.tmp"113⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\9897.tmp"C:\Users\Admin\AppData\Local\Temp\9897.tmp"114⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\98D6.tmp"C:\Users\Admin\AppData\Local\Temp\98D6.tmp"115⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\9914.tmp"C:\Users\Admin\AppData\Local\Temp\9914.tmp"116⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\9953.tmp"C:\Users\Admin\AppData\Local\Temp\9953.tmp"117⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\9991.tmp"C:\Users\Admin\AppData\Local\Temp\9991.tmp"118⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\99CF.tmp"C:\Users\Admin\AppData\Local\Temp\99CF.tmp"119⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"C:\Users\Admin\AppData\Local\Temp\9A0E.tmp"120⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"121⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"C:\Users\Admin\AppData\Local\Temp\9A8B.tmp"122⤵PID:2748
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-