Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
14/10/2024, 07:27
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe
-
Size
529KB
-
MD5
ee944b0fe715bf69f4eb299abc9c6131
-
SHA1
1a09c4b0066d2841e8133a2400b0311f373010d9
-
SHA256
3086f9e528622eadd63b33decf8a7958546c6aa61553ade9cdaf16231226cf95
-
SHA512
dccd93cf855d28ea0ce453ed9e0581bd9a85a01b1d11c7251d5b6e4e6e965584d8ed98fb038f80e6947d82a9c0ea1ef7b27bcbef2e9191129ac4f660b0fde83b
-
SSDEEP
12288:NU5rCOTeijGnkob7GTVmBUDGXrAiflZoZTZwlH4Hp:NUQOJjUkaSMdsiflGZTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2892 2DC4.tmp 2744 2E51.tmp 2644 2ECE.tmp 2672 2FE6.tmp 2948 30A2.tmp 2900 31BA.tmp 2668 3247.tmp 2112 336F.tmp 2012 3488.tmp 1348 3572.tmp 1820 361E.tmp 3036 36E8.tmp 2932 3784.tmp 1444 38BC.tmp 2924 3968.tmp 1116 3A23.tmp 2032 3B4C.tmp 2036 3BD8.tmp 2376 3CE1.tmp 1632 3DCB.tmp 332 3EB5.tmp 1740 3FDE.tmp 2188 407A.tmp 2392 4116.tmp 1620 4192.tmp 1896 420F.tmp 2160 42AB.tmp 3012 4338.tmp 760 43B4.tmp 2352 4412.tmp 1592 44AE.tmp 1628 453A.tmp 1980 45E6.tmp 1732 4672.tmp 1724 46EF.tmp 1256 47BA.tmp 2380 4837.tmp 780 48B4.tmp 1288 496F.tmp 1696 4A1A.tmp 2052 4A88.tmp 2584 4B14.tmp 884 4B81.tmp 960 4C0E.tmp 1284 4C8A.tmp 2556 4D46.tmp 2404 4DC2.tmp 1828 4E4F.tmp 1876 4ECC.tmp 2240 4F68.tmp 2412 4FE4.tmp 1580 5061.tmp 2856 50FD.tmp 2896 518A.tmp 2768 5206.tmp 2060 5293.tmp 2068 5310.tmp 2912 538C.tmp 2672 5512.tmp 2800 562B.tmp 2708 5698.tmp 1780 5734.tmp 2144 57C1.tmp 1268 584D.tmp -
Loads dropped DLL 64 IoCs
pid Process 2872 2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe 2892 2DC4.tmp 2744 2E51.tmp 2644 2ECE.tmp 2672 2FE6.tmp 2948 30A2.tmp 2900 31BA.tmp 2668 3247.tmp 2112 336F.tmp 2012 3488.tmp 1348 3572.tmp 1820 361E.tmp 3036 36E8.tmp 2932 3784.tmp 1444 38BC.tmp 2924 3968.tmp 1116 3A23.tmp 2032 3B4C.tmp 2036 3BD8.tmp 2376 3CE1.tmp 1632 3DCB.tmp 332 3EB5.tmp 1740 3FDE.tmp 2188 407A.tmp 2392 4116.tmp 1620 4192.tmp 1896 420F.tmp 2160 42AB.tmp 3012 4338.tmp 760 43B4.tmp 2352 4412.tmp 1592 44AE.tmp 1628 453A.tmp 1980 45E6.tmp 1732 4672.tmp 1724 46EF.tmp 1256 47BA.tmp 2380 4837.tmp 780 48B4.tmp 1288 496F.tmp 1696 4A1A.tmp 2052 4A88.tmp 2584 4B14.tmp 884 4B81.tmp 960 4C0E.tmp 1284 4C8A.tmp 2556 4D46.tmp 2404 4DC2.tmp 1828 4E4F.tmp 1876 4ECC.tmp 2240 4F68.tmp 2412 4FE4.tmp 1580 5061.tmp 2856 50FD.tmp 2896 518A.tmp 2768 5206.tmp 2060 5293.tmp 2068 5310.tmp 2912 538C.tmp 2672 5512.tmp 2800 562B.tmp 2708 5698.tmp 1780 5734.tmp 2144 57C1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3830.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 90AC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B24F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BC4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EABC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0B9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E0CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9648.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F8D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1AC1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E1C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2433.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2FE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 311E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3EB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D0E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F180.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 342A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6EF9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 651A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2167.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3591.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5773.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FD72.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3489.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E060.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFC2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C3AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CA03.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DFC4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1777.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5206.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 584D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 846C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E550.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E8AA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 871A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AC94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1861.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2DC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7495.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7899.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38BE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2872 wrote to memory of 2892 2872 2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe 30 PID 2872 wrote to memory of 2892 2872 2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe 30 PID 2872 wrote to memory of 2892 2872 2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe 30 PID 2872 wrote to memory of 2892 2872 2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe 30 PID 2892 wrote to memory of 2744 2892 2DC4.tmp 31 PID 2892 wrote to memory of 2744 2892 2DC4.tmp 31 PID 2892 wrote to memory of 2744 2892 2DC4.tmp 31 PID 2892 wrote to memory of 2744 2892 2DC4.tmp 31 PID 2744 wrote to memory of 2644 2744 2E51.tmp 32 PID 2744 wrote to memory of 2644 2744 2E51.tmp 32 PID 2744 wrote to memory of 2644 2744 2E51.tmp 32 PID 2744 wrote to memory of 2644 2744 2E51.tmp 32 PID 2644 wrote to memory of 2672 2644 2ECE.tmp 33 PID 2644 wrote to memory of 2672 2644 2ECE.tmp 33 PID 2644 wrote to memory of 2672 2644 2ECE.tmp 33 PID 2644 wrote to memory of 2672 2644 2ECE.tmp 33 PID 2672 wrote to memory of 2948 2672 2FE6.tmp 34 PID 2672 wrote to memory of 2948 2672 2FE6.tmp 34 PID 2672 wrote to memory of 2948 2672 2FE6.tmp 34 PID 2672 wrote to memory of 2948 2672 2FE6.tmp 34 PID 2948 wrote to memory of 2900 2948 30A2.tmp 35 PID 2948 wrote to memory of 2900 2948 30A2.tmp 35 PID 2948 wrote to memory of 2900 2948 30A2.tmp 35 PID 2948 wrote to memory of 2900 2948 30A2.tmp 35 PID 2900 wrote to memory of 2668 2900 31BA.tmp 36 PID 2900 wrote to memory of 2668 2900 31BA.tmp 36 PID 2900 wrote to memory of 2668 2900 31BA.tmp 36 PID 2900 wrote to memory of 2668 2900 31BA.tmp 36 PID 2668 wrote to memory of 2112 2668 3247.tmp 37 PID 2668 wrote to memory of 2112 2668 3247.tmp 37 PID 2668 wrote to memory of 2112 2668 3247.tmp 37 PID 2668 wrote to memory of 2112 2668 3247.tmp 37 PID 2112 wrote to memory of 2012 2112 336F.tmp 38 PID 2112 wrote to memory of 2012 2112 336F.tmp 38 PID 2112 wrote to memory of 2012 2112 336F.tmp 38 PID 2112 wrote to memory of 2012 2112 336F.tmp 38 PID 2012 wrote to memory of 1348 2012 3488.tmp 39 PID 2012 wrote to memory of 1348 2012 3488.tmp 39 PID 2012 wrote to memory of 1348 2012 3488.tmp 39 PID 2012 wrote to memory of 1348 2012 3488.tmp 39 PID 1348 wrote to memory of 1820 1348 3572.tmp 40 PID 1348 wrote to memory of 1820 1348 3572.tmp 40 PID 1348 wrote to memory of 1820 1348 3572.tmp 40 PID 1348 wrote to memory of 1820 1348 3572.tmp 40 PID 1820 wrote to memory of 3036 1820 361E.tmp 41 PID 1820 wrote to memory of 3036 1820 361E.tmp 41 PID 1820 wrote to memory of 3036 1820 361E.tmp 41 PID 1820 wrote to memory of 3036 1820 361E.tmp 41 PID 3036 wrote to memory of 2932 3036 36E8.tmp 42 PID 3036 wrote to memory of 2932 3036 36E8.tmp 42 PID 3036 wrote to memory of 2932 3036 36E8.tmp 42 PID 3036 wrote to memory of 2932 3036 36E8.tmp 42 PID 2932 wrote to memory of 1444 2932 3784.tmp 43 PID 2932 wrote to memory of 1444 2932 3784.tmp 43 PID 2932 wrote to memory of 1444 2932 3784.tmp 43 PID 2932 wrote to memory of 1444 2932 3784.tmp 43 PID 1444 wrote to memory of 2924 1444 38BC.tmp 44 PID 1444 wrote to memory of 2924 1444 38BC.tmp 44 PID 1444 wrote to memory of 2924 1444 38BC.tmp 44 PID 1444 wrote to memory of 2924 1444 38BC.tmp 44 PID 2924 wrote to memory of 1116 2924 3968.tmp 45 PID 2924 wrote to memory of 1116 2924 3968.tmp 45 PID 2924 wrote to memory of 1116 2924 3968.tmp 45 PID 2924 wrote to memory of 1116 2924 3968.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-14_ee944b0fe715bf69f4eb299abc9c6131_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"C:\Users\Admin\AppData\Local\Temp\2FE6.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\30A2.tmp"C:\Users\Admin\AppData\Local\Temp\30A2.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\31BA.tmp"C:\Users\Admin\AppData\Local\Temp\31BA.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\336F.tmp"C:\Users\Admin\AppData\Local\Temp\336F.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\3572.tmp"C:\Users\Admin\AppData\Local\Temp\3572.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\36E8.tmp"C:\Users\Admin\AppData\Local\Temp\36E8.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\38BC.tmp"C:\Users\Admin\AppData\Local\Temp\38BC.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3968.tmp"C:\Users\Admin\AppData\Local\Temp\3968.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3A23.tmp"C:\Users\Admin\AppData\Local\Temp\3A23.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"C:\Users\Admin\AppData\Local\Temp\3B4C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"C:\Users\Admin\AppData\Local\Temp\3BD8.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"C:\Users\Admin\AppData\Local\Temp\3CE1.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"C:\Users\Admin\AppData\Local\Temp\3EB5.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:332 -
C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"C:\Users\Admin\AppData\Local\Temp\3FDE.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\4192.tmp"C:\Users\Admin\AppData\Local\Temp\4192.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\420F.tmp"C:\Users\Admin\AppData\Local\Temp\420F.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4338.tmp"C:\Users\Admin\AppData\Local\Temp\4338.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\43B4.tmp"C:\Users\Admin\AppData\Local\Temp\43B4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\4412.tmp"C:\Users\Admin\AppData\Local\Temp\4412.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\45E6.tmp"C:\Users\Admin\AppData\Local\Temp\45E6.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4672.tmp"C:\Users\Admin\AppData\Local\Temp\4672.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\46EF.tmp"C:\Users\Admin\AppData\Local\Temp\46EF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\47BA.tmp"C:\Users\Admin\AppData\Local\Temp\47BA.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4837.tmp"C:\Users\Admin\AppData\Local\Temp\4837.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\48B4.tmp"C:\Users\Admin\AppData\Local\Temp\48B4.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780 -
C:\Users\Admin\AppData\Local\Temp\496F.tmp"C:\Users\Admin\AppData\Local\Temp\496F.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"C:\Users\Admin\AppData\Local\Temp\4A1A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4A88.tmp"C:\Users\Admin\AppData\Local\Temp\4A88.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4B14.tmp"C:\Users\Admin\AppData\Local\Temp\4B14.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4B81.tmp"C:\Users\Admin\AppData\Local\Temp\4B81.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"C:\Users\Admin\AppData\Local\Temp\4C0E.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:960 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\4D46.tmp"C:\Users\Admin\AppData\Local\Temp\4D46.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"C:\Users\Admin\AppData\Local\Temp\4FE4.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5061.tmp"C:\Users\Admin\AppData\Local\Temp\5061.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\50FD.tmp"C:\Users\Admin\AppData\Local\Temp\50FD.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\518A.tmp"C:\Users\Admin\AppData\Local\Temp\518A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\5206.tmp"C:\Users\Admin\AppData\Local\Temp\5206.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5293.tmp"C:\Users\Admin\AppData\Local\Temp\5293.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\5310.tmp"C:\Users\Admin\AppData\Local\Temp\5310.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\538C.tmp"C:\Users\Admin\AppData\Local\Temp\538C.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5512.tmp"C:\Users\Admin\AppData\Local\Temp\5512.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\562B.tmp"C:\Users\Admin\AppData\Local\Temp\562B.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\5698.tmp"C:\Users\Admin\AppData\Local\Temp\5698.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\5734.tmp"C:\Users\Admin\AppData\Local\Temp\5734.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\57C1.tmp"C:\Users\Admin\AppData\Local\Temp\57C1.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\584D.tmp"C:\Users\Admin\AppData\Local\Temp\584D.tmp"65⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\58CA.tmp"C:\Users\Admin\AppData\Local\Temp\58CA.tmp"66⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5966.tmp"C:\Users\Admin\AppData\Local\Temp\5966.tmp"67⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\59D3.tmp"C:\Users\Admin\AppData\Local\Temp\59D3.tmp"68⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\5A50.tmp"C:\Users\Admin\AppData\Local\Temp\5A50.tmp"69⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"C:\Users\Admin\AppData\Local\Temp\5ADD.tmp"70⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\5B69.tmp"C:\Users\Admin\AppData\Local\Temp\5B69.tmp"71⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\5C05.tmp"C:\Users\Admin\AppData\Local\Temp\5C05.tmp"72⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\5C91.tmp"C:\Users\Admin\AppData\Local\Temp\5C91.tmp"73⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"C:\Users\Admin\AppData\Local\Temp\5D0E.tmp"74⤵
- System Location Discovery: System Language Discovery
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"C:\Users\Admin\AppData\Local\Temp\5DBA.tmp"75⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\5E27.tmp"C:\Users\Admin\AppData\Local\Temp\5E27.tmp"76⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"C:\Users\Admin\AppData\Local\Temp\5EC3.tmp"77⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5F30.tmp"C:\Users\Admin\AppData\Local\Temp\5F30.tmp"78⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"C:\Users\Admin\AppData\Local\Temp\5FAD.tmp"79⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\6039.tmp"C:\Users\Admin\AppData\Local\Temp\6039.tmp"80⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\60B6.tmp"C:\Users\Admin\AppData\Local\Temp\60B6.tmp"81⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\6133.tmp"C:\Users\Admin\AppData\Local\Temp\6133.tmp"82⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\61BF.tmp"C:\Users\Admin\AppData\Local\Temp\61BF.tmp"83⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\622D.tmp"C:\Users\Admin\AppData\Local\Temp\622D.tmp"84⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\62B9.tmp"C:\Users\Admin\AppData\Local\Temp\62B9.tmp"85⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\6345.tmp"C:\Users\Admin\AppData\Local\Temp\6345.tmp"86⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\63E1.tmp"C:\Users\Admin\AppData\Local\Temp\63E1.tmp"87⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\645E.tmp"C:\Users\Admin\AppData\Local\Temp\645E.tmp"88⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\6519.tmp"C:\Users\Admin\AppData\Local\Temp\6519.tmp"89⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\65B5.tmp"C:\Users\Admin\AppData\Local\Temp\65B5.tmp"90⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\6651.tmp"C:\Users\Admin\AppData\Local\Temp\6651.tmp"91⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\66BF.tmp"C:\Users\Admin\AppData\Local\Temp\66BF.tmp"92⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\674B.tmp"C:\Users\Admin\AppData\Local\Temp\674B.tmp"93⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\67D7.tmp"C:\Users\Admin\AppData\Local\Temp\67D7.tmp"94⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\6845.tmp"C:\Users\Admin\AppData\Local\Temp\6845.tmp"95⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\68B2.tmp"C:\Users\Admin\AppData\Local\Temp\68B2.tmp"96⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\694E.tmp"C:\Users\Admin\AppData\Local\Temp\694E.tmp"97⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\69EA.tmp"C:\Users\Admin\AppData\Local\Temp\69EA.tmp"98⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\6B03.tmp"C:\Users\Admin\AppData\Local\Temp\6B03.tmp"99⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"C:\Users\Admin\AppData\Local\Temp\6B7F.tmp"100⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"C:\Users\Admin\AppData\Local\Temp\6C2B.tmp"101⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"C:\Users\Admin\AppData\Local\Temp\6CA8.tmp"102⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"103⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"C:\Users\Admin\AppData\Local\Temp\6DC1.tmp"104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"105⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"C:\Users\Admin\AppData\Local\Temp\6EF9.tmp"106⤵
- System Location Discovery: System Language Discovery
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\6F75.tmp"C:\Users\Admin\AppData\Local\Temp\6F75.tmp"107⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"C:\Users\Admin\AppData\Local\Temp\6FF2.tmp"108⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\707F.tmp"C:\Users\Admin\AppData\Local\Temp\707F.tmp"109⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\70EC.tmp"C:\Users\Admin\AppData\Local\Temp\70EC.tmp"110⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\7169.tmp"C:\Users\Admin\AppData\Local\Temp\7169.tmp"111⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\7224.tmp"C:\Users\Admin\AppData\Local\Temp\7224.tmp"112⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\7291.tmp"C:\Users\Admin\AppData\Local\Temp\7291.tmp"113⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\730E.tmp"C:\Users\Admin\AppData\Local\Temp\730E.tmp"114⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"115⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"116⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"117⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\7511.tmp"C:\Users\Admin\AppData\Local\Temp\7511.tmp"118⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"119⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\7629.tmp"C:\Users\Admin\AppData\Local\Temp\7629.tmp"120⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\76D5.tmp"C:\Users\Admin\AppData\Local\Temp\76D5.tmp"121⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"122⤵PID:2952
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-