Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07/08/2024, 00:35 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe
-
Size
488KB
-
MD5
c10b4d1a6467a5257ed8b24cc51e59b3
-
SHA1
295d41187f5183d605a2f567085a6be7f8fea0d4
-
SHA256
1e79a82cc2b23f1d11c71bd64cfed2319ce9f2786ae424b16194790ddb0ac25d
-
SHA512
ccd36570d365d9bf5c0a2ddd1a757184dad210dda358c5025414bdacda5acff1b0b56771d6a8a79aede486593df07326f2740a2a9503a0abeb479477f8d068d5
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7yLMPdtw53DDTvKSXjFrQtQK1L3YKArfDqsHT:/U5rCOTeiDqQveTDjZFExArfDbNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2748 F2E7.tmp 2664 F344.tmp 2940 F3D1.tmp 2840 F42E.tmp 2712 F49C.tmp 2532 F4F9.tmp 2616 F547.tmp 2208 F5A5.tmp 796 F602.tmp 2716 F670.tmp 2340 F6DD.tmp 788 F73A.tmp 1700 F798.tmp 1220 F805.tmp 1036 F872.tmp 580 F8D0.tmp 1052 F92E.tmp 1716 F98B.tmp 1828 F9E9.tmp 2516 FA56.tmp 2972 FAB4.tmp 1880 FB21.tmp 2988 FB5F.tmp 3060 FB9E.tmp 2180 FBDC.tmp 1692 FC1A.tmp 408 FC68.tmp 2100 FCA7.tmp 2108 FCE5.tmp 2400 FD24.tmp 2416 FD62.tmp 1304 FDA0.tmp 2296 FDDF.tmp 888 FE1D.tmp 840 FE5C.tmp 2468 FE9A.tmp 1376 FED8.tmp 1020 FF17.tmp 284 FF55.tmp 1812 FF94.tmp 996 FFD2.tmp 1708 10.tmp 2272 4F.tmp 2452 8D.tmp 2280 CC.tmp 2308 10A.tmp 1668 148.tmp 1824 196.tmp 1948 1D5.tmp 2828 213.tmp 2680 252.tmp 1944 290.tmp 1600 2CE.tmp 2696 31C.tmp 2692 35B.tmp 2672 399.tmp 2944 3E7.tmp 2564 426.tmp 2880 464.tmp 2676 4B2.tmp 2536 500.tmp 2556 53E.tmp 292 57D.tmp 2396 5BB.tmp -
Loads dropped DLL 64 IoCs
pid Process 2688 2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe 2748 F2E7.tmp 2664 F344.tmp 2940 F3D1.tmp 2840 F42E.tmp 2712 F49C.tmp 2532 F4F9.tmp 2616 F547.tmp 2208 F5A5.tmp 796 F602.tmp 2716 F670.tmp 2340 F6DD.tmp 788 F73A.tmp 1700 F798.tmp 1220 F805.tmp 1036 F872.tmp 580 F8D0.tmp 1052 F92E.tmp 1716 F98B.tmp 1828 F9E9.tmp 2516 FA56.tmp 2972 FAB4.tmp 1880 FB21.tmp 2988 FB5F.tmp 3060 FB9E.tmp 2180 FBDC.tmp 1692 FC1A.tmp 408 FC68.tmp 2100 FCA7.tmp 2108 FCE5.tmp 2400 FD24.tmp 2416 FD62.tmp 1304 FDA0.tmp 2296 FDDF.tmp 888 FE1D.tmp 840 FE5C.tmp 2468 FE9A.tmp 1376 FED8.tmp 1020 FF17.tmp 284 FF55.tmp 1812 FF94.tmp 996 FFD2.tmp 1708 10.tmp 2272 4F.tmp 2452 8D.tmp 2280 CC.tmp 2308 10A.tmp 1668 148.tmp 1824 196.tmp 1948 1D5.tmp 2828 213.tmp 2680 252.tmp 1944 290.tmp 1600 2CE.tmp 2696 31C.tmp 2692 35B.tmp 2672 399.tmp 2944 3E7.tmp 2564 426.tmp 2880 464.tmp 2676 4B2.tmp 2536 500.tmp 2556 53E.tmp 292 57D.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5679.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B490.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8160.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EB0A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F392.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B8C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 713A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B4E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F45.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A91B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 512C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8037.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EAF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E762.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1130.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1381.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C9A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5918.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 195A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A860.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B00D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 52F0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A8D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 94E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D172.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2748 2688 2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe 30 PID 2688 wrote to memory of 2748 2688 2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe 30 PID 2688 wrote to memory of 2748 2688 2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe 30 PID 2688 wrote to memory of 2748 2688 2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe 30 PID 2748 wrote to memory of 2664 2748 F2E7.tmp 31 PID 2748 wrote to memory of 2664 2748 F2E7.tmp 31 PID 2748 wrote to memory of 2664 2748 F2E7.tmp 31 PID 2748 wrote to memory of 2664 2748 F2E7.tmp 31 PID 2664 wrote to memory of 2940 2664 F344.tmp 32 PID 2664 wrote to memory of 2940 2664 F344.tmp 32 PID 2664 wrote to memory of 2940 2664 F344.tmp 32 PID 2664 wrote to memory of 2940 2664 F344.tmp 32 PID 2940 wrote to memory of 2840 2940 F3D1.tmp 33 PID 2940 wrote to memory of 2840 2940 F3D1.tmp 33 PID 2940 wrote to memory of 2840 2940 F3D1.tmp 33 PID 2940 wrote to memory of 2840 2940 F3D1.tmp 33 PID 2840 wrote to memory of 2712 2840 F42E.tmp 34 PID 2840 wrote to memory of 2712 2840 F42E.tmp 34 PID 2840 wrote to memory of 2712 2840 F42E.tmp 34 PID 2840 wrote to memory of 2712 2840 F42E.tmp 34 PID 2712 wrote to memory of 2532 2712 F49C.tmp 35 PID 2712 wrote to memory of 2532 2712 F49C.tmp 35 PID 2712 wrote to memory of 2532 2712 F49C.tmp 35 PID 2712 wrote to memory of 2532 2712 F49C.tmp 35 PID 2532 wrote to memory of 2616 2532 F4F9.tmp 36 PID 2532 wrote to memory of 2616 2532 F4F9.tmp 36 PID 2532 wrote to memory of 2616 2532 F4F9.tmp 36 PID 2532 wrote to memory of 2616 2532 F4F9.tmp 36 PID 2616 wrote to memory of 2208 2616 F547.tmp 37 PID 2616 wrote to memory of 2208 2616 F547.tmp 37 PID 2616 wrote to memory of 2208 2616 F547.tmp 37 PID 2616 wrote to memory of 2208 2616 F547.tmp 37 PID 2208 wrote to memory of 796 2208 F5A5.tmp 38 PID 2208 wrote to memory of 796 2208 F5A5.tmp 38 PID 2208 wrote to memory of 796 2208 F5A5.tmp 38 PID 2208 wrote to memory of 796 2208 F5A5.tmp 38 PID 796 wrote to memory of 2716 796 F602.tmp 39 PID 796 wrote to memory of 2716 796 F602.tmp 39 PID 796 wrote to memory of 2716 796 F602.tmp 39 PID 796 wrote to memory of 2716 796 F602.tmp 39 PID 2716 wrote to memory of 2340 2716 F670.tmp 40 PID 2716 wrote to memory of 2340 2716 F670.tmp 40 PID 2716 wrote to memory of 2340 2716 F670.tmp 40 PID 2716 wrote to memory of 2340 2716 F670.tmp 40 PID 2340 wrote to memory of 788 2340 F6DD.tmp 41 PID 2340 wrote to memory of 788 2340 F6DD.tmp 41 PID 2340 wrote to memory of 788 2340 F6DD.tmp 41 PID 2340 wrote to memory of 788 2340 F6DD.tmp 41 PID 788 wrote to memory of 1700 788 F73A.tmp 42 PID 788 wrote to memory of 1700 788 F73A.tmp 42 PID 788 wrote to memory of 1700 788 F73A.tmp 42 PID 788 wrote to memory of 1700 788 F73A.tmp 42 PID 1700 wrote to memory of 1220 1700 F798.tmp 43 PID 1700 wrote to memory of 1220 1700 F798.tmp 43 PID 1700 wrote to memory of 1220 1700 F798.tmp 43 PID 1700 wrote to memory of 1220 1700 F798.tmp 43 PID 1220 wrote to memory of 1036 1220 F805.tmp 44 PID 1220 wrote to memory of 1036 1220 F805.tmp 44 PID 1220 wrote to memory of 1036 1220 F805.tmp 44 PID 1220 wrote to memory of 1036 1220 F805.tmp 44 PID 1036 wrote to memory of 580 1036 F872.tmp 45 PID 1036 wrote to memory of 580 1036 F872.tmp 45 PID 1036 wrote to memory of 580 1036 F872.tmp 45 PID 1036 wrote to memory of 580 1036 F872.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_c10b4d1a6467a5257ed8b24cc51e59b3_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\F344.tmp"C:\Users\Admin\AppData\Local\Temp\F344.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"C:\Users\Admin\AppData\Local\Temp\F3D1.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\F49C.tmp"C:\Users\Admin\AppData\Local\Temp\F49C.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"C:\Users\Admin\AppData\Local\Temp\F4F9.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\F602.tmp"C:\Users\Admin\AppData\Local\Temp\F602.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\F670.tmp"C:\Users\Admin\AppData\Local\Temp\F670.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"C:\Users\Admin\AppData\Local\Temp\F6DD.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\F73A.tmp"C:\Users\Admin\AppData\Local\Temp\F73A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\F798.tmp"C:\Users\Admin\AppData\Local\Temp\F798.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\F805.tmp"C:\Users\Admin\AppData\Local\Temp\F805.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"C:\Users\Admin\AppData\Local\Temp\F8D0.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:580 -
C:\Users\Admin\AppData\Local\Temp\F92E.tmp"C:\Users\Admin\AppData\Local\Temp\F92E.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\F98B.tmp"C:\Users\Admin\AppData\Local\Temp\F98B.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"C:\Users\Admin\AppData\Local\Temp\F9E9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\FA56.tmp"C:\Users\Admin\AppData\Local\Temp\FA56.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"C:\Users\Admin\AppData\Local\Temp\FAB4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\FB21.tmp"C:\Users\Admin\AppData\Local\Temp\FB21.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"C:\Users\Admin\AppData\Local\Temp\FB5F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"C:\Users\Admin\AppData\Local\Temp\FB9E.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"C:\Users\Admin\AppData\Local\Temp\FBDC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\FC68.tmp"C:\Users\Admin\AppData\Local\Temp\FC68.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:408 -
C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"C:\Users\Admin\AppData\Local\Temp\FCA7.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"C:\Users\Admin\AppData\Local\Temp\FCE5.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\FD24.tmp"C:\Users\Admin\AppData\Local\Temp\FD24.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\FD62.tmp"C:\Users\Admin\AppData\Local\Temp\FD62.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"C:\Users\Admin\AppData\Local\Temp\FDA0.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"C:\Users\Admin\AppData\Local\Temp\FE1D.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:888 -
C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"C:\Users\Admin\AppData\Local\Temp\FE5C.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:840 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\FF17.tmp"C:\Users\Admin\AppData\Local\Temp\FF17.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\FF55.tmp"C:\Users\Admin\AppData\Local\Temp\FF55.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\FF94.tmp"C:\Users\Admin\AppData\Local\Temp\FF94.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"C:\Users\Admin\AppData\Local\Temp\FFD2.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\10.tmp"C:\Users\Admin\AppData\Local\Temp\10.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4F.tmp"C:\Users\Admin\AppData\Local\Temp\4F.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8D.tmp"C:\Users\Admin\AppData\Local\Temp\8D.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\CC.tmp"C:\Users\Admin\AppData\Local\Temp\CC.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\10A.tmp"C:\Users\Admin\AppData\Local\Temp\10A.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\196.tmp"C:\Users\Admin\AppData\Local\Temp\196.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\252.tmp"C:\Users\Admin\AppData\Local\Temp\252.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\2CE.tmp"C:\Users\Admin\AppData\Local\Temp\2CE.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\31C.tmp"C:\Users\Admin\AppData\Local\Temp\31C.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\35B.tmp"C:\Users\Admin\AppData\Local\Temp\35B.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\399.tmp"C:\Users\Admin\AppData\Local\Temp\399.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\426.tmp"C:\Users\Admin\AppData\Local\Temp\426.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\464.tmp"C:\Users\Admin\AppData\Local\Temp\464.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\4B2.tmp"C:\Users\Admin\AppData\Local\Temp\4B2.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\53E.tmp"C:\Users\Admin\AppData\Local\Temp\53E.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\57D.tmp"C:\Users\Admin\AppData\Local\Temp\57D.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:292 -
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"65⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\619.tmp"C:\Users\Admin\AppData\Local\Temp\619.tmp"66⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\667.tmp"C:\Users\Admin\AppData\Local\Temp\667.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6A5.tmp"C:\Users\Admin\AppData\Local\Temp\6A5.tmp"68⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"69⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\732.tmp"C:\Users\Admin\AppData\Local\Temp\732.tmp"70⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\770.tmp"C:\Users\Admin\AppData\Local\Temp\770.tmp"71⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\7CE.tmp"C:\Users\Admin\AppData\Local\Temp\7CE.tmp"72⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"73⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\84A.tmp"C:\Users\Admin\AppData\Local\Temp\84A.tmp"74⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\889.tmp"C:\Users\Admin\AppData\Local\Temp\889.tmp"75⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"76⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\915.tmp"C:\Users\Admin\AppData\Local\Temp\915.tmp"77⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\954.tmp"C:\Users\Admin\AppData\Local\Temp\954.tmp"78⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\9A2.tmp"C:\Users\Admin\AppData\Local\Temp\9A2.tmp"79⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\9E0.tmp"C:\Users\Admin\AppData\Local\Temp\9E0.tmp"80⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\A1E.tmp"C:\Users\Admin\AppData\Local\Temp\A1E.tmp"81⤵PID:2884
-
C:\Users\Admin\AppData\Local\Temp\A5D.tmp"C:\Users\Admin\AppData\Local\Temp\A5D.tmp"82⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\A9B.tmp"C:\Users\Admin\AppData\Local\Temp\A9B.tmp"83⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"84⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\B18.tmp"C:\Users\Admin\AppData\Local\Temp\B18.tmp"85⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\B56.tmp"C:\Users\Admin\AppData\Local\Temp\B56.tmp"86⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\BA4.tmp"C:\Users\Admin\AppData\Local\Temp\BA4.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\BE3.tmp"C:\Users\Admin\AppData\Local\Temp\BE3.tmp"88⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"89⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"90⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"91⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"92⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:408 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"94⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"96⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"97⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\E62.tmp"C:\Users\Admin\AppData\Local\Temp\E62.tmp"98⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"99⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\EDF.tmp"C:\Users\Admin\AppData\Local\Temp\EDF.tmp"100⤵PID:568
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"101⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"102⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"103⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"104⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"105⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"106⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\10A4.tmp"C:\Users\Admin\AppData\Local\Temp\10A4.tmp"107⤵
- System Location Discovery: System Language Discovery
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"108⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"109⤵
- System Location Discovery: System Language Discovery
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"110⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\11AD.tmp"C:\Users\Admin\AppData\Local\Temp\11AD.tmp"111⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\11EB.tmp"C:\Users\Admin\AppData\Local\Temp\11EB.tmp"112⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\1239.tmp"C:\Users\Admin\AppData\Local\Temp\1239.tmp"113⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\1278.tmp"C:\Users\Admin\AppData\Local\Temp\1278.tmp"114⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"115⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\12F4.tmp"C:\Users\Admin\AppData\Local\Temp\12F4.tmp"116⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"117⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"119⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"120⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\144C.tmp"C:\Users\Admin\AppData\Local\Temp\144C.tmp"121⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\149A.tmp"C:\Users\Admin\AppData\Local\Temp\149A.tmp"122⤵PID:2804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-