Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe
-
Size
488KB
-
MD5
cca27a7944ab343957631f54cdfdd95b
-
SHA1
7eb85e442c9ed891451fd535c85ee893cc1ac784
-
SHA256
fe2542c429bc0bc890b2f9e288b4b82fd91577afa6ace698fdbbcbaab2a4264b
-
SHA512
2653295608794fbc47e55751256785d8d848122fef2b2422a69f36cd7e9a8d492bda17ad207d697a03d8df886fb6a646ebeedcf4b8de840536c4d9452eded307
-
SSDEEP
12288:/U5rCOTeiD0NkUz5eigBVubnjqrFiNNZ:/UQOJD0NrxgmbjqrFiNN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2160 E198.tmp 1744 E206.tmp 2804 E282.tmp 3012 E2F0.tmp 2848 E33E.tmp 2596 E3AB.tmp 2744 E3F9.tmp 2564 E456.tmp 2644 E4B4.tmp 2124 E531.tmp 264 E59E.tmp 2968 E5FC.tmp 2264 E669.tmp 2000 E6C6.tmp 1920 E734.tmp 1424 E791.tmp 836 E7EF.tmp 2888 E85C.tmp 2900 E8D9.tmp 484 E946.tmp 1940 E9A4.tmp 1676 EA11.tmp 2116 EA5F.tmp 1988 EA9D.tmp 3040 EADC.tmp 2532 EB2A.tmp 1708 EB68.tmp 1588 EBB6.tmp 448 EBF4.tmp 2364 EC42.tmp 1660 EC81.tmp 1288 ECCF.tmp 2536 ED0D.tmp 1600 ED4C.tmp 1656 ED8A.tmp 832 EDC8.tmp 1704 EE07.tmp 908 EE55.tmp 1480 EE93.tmp 2468 EEE1.tmp 1668 EF2F.tmp 2060 EF6E.tmp 584 EFAC.tmp 984 EFEA.tmp 2476 F038.tmp 1576 F077.tmp 2288 F0B5.tmp 1232 F0F4.tmp 876 F122.tmp 2344 F161.tmp 2184 F19F.tmp 1624 F1DE.tmp 2408 F21C.tmp 2712 F26A.tmp 2716 F2A8.tmp 2780 F2F6.tmp 796 F335.tmp 3008 F373.tmp 2688 F3B2.tmp 2812 F3F0.tmp 1200 F42E.tmp 2684 F46D.tmp 2580 F4CA.tmp 2584 F509.tmp -
Loads dropped DLL 64 IoCs
pid Process 2756 2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe 2160 E198.tmp 1744 E206.tmp 2804 E282.tmp 3012 E2F0.tmp 2848 E33E.tmp 2596 E3AB.tmp 2744 E3F9.tmp 2564 E456.tmp 2644 E4B4.tmp 2124 E531.tmp 264 E59E.tmp 2968 E5FC.tmp 2264 E669.tmp 2000 E6C6.tmp 1920 E734.tmp 1424 E791.tmp 836 E7EF.tmp 2888 E85C.tmp 2900 E8D9.tmp 484 E946.tmp 1940 E9A4.tmp 1676 EA11.tmp 2116 EA5F.tmp 1988 EA9D.tmp 3040 EADC.tmp 2532 EB2A.tmp 1708 EB68.tmp 1588 EBB6.tmp 448 EBF4.tmp 2364 EC42.tmp 1660 EC81.tmp 1288 ECCF.tmp 2536 ED0D.tmp 1600 ED4C.tmp 1656 ED8A.tmp 832 EDC8.tmp 1704 EE07.tmp 908 EE55.tmp 1480 EE93.tmp 2468 EEE1.tmp 1668 EF2F.tmp 2060 EF6E.tmp 584 EFAC.tmp 984 EFEA.tmp 2476 F038.tmp 1576 F077.tmp 2288 F0B5.tmp 1232 F0F4.tmp 876 F122.tmp 2344 F161.tmp 2184 F19F.tmp 1624 F1DE.tmp 2408 F21C.tmp 2712 F26A.tmp 2716 F2A8.tmp 2780 F2F6.tmp 796 F335.tmp 3008 F373.tmp 2688 F3B2.tmp 2812 F3F0.tmp 1200 F42E.tmp 2684 F46D.tmp 2580 F4CA.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA94.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9434.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F0B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C014.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6DE0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 952E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A38F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7A5E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5A41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 84F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F335.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B847.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3CB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5C82.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E7E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1C09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F26A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 405A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB34.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2160 2756 2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe 31 PID 2756 wrote to memory of 2160 2756 2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe 31 PID 2756 wrote to memory of 2160 2756 2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe 31 PID 2756 wrote to memory of 2160 2756 2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe 31 PID 2160 wrote to memory of 1744 2160 E198.tmp 32 PID 2160 wrote to memory of 1744 2160 E198.tmp 32 PID 2160 wrote to memory of 1744 2160 E198.tmp 32 PID 2160 wrote to memory of 1744 2160 E198.tmp 32 PID 1744 wrote to memory of 2804 1744 E206.tmp 33 PID 1744 wrote to memory of 2804 1744 E206.tmp 33 PID 1744 wrote to memory of 2804 1744 E206.tmp 33 PID 1744 wrote to memory of 2804 1744 E206.tmp 33 PID 2804 wrote to memory of 3012 2804 E282.tmp 34 PID 2804 wrote to memory of 3012 2804 E282.tmp 34 PID 2804 wrote to memory of 3012 2804 E282.tmp 34 PID 2804 wrote to memory of 3012 2804 E282.tmp 34 PID 3012 wrote to memory of 2848 3012 E2F0.tmp 35 PID 3012 wrote to memory of 2848 3012 E2F0.tmp 35 PID 3012 wrote to memory of 2848 3012 E2F0.tmp 35 PID 3012 wrote to memory of 2848 3012 E2F0.tmp 35 PID 2848 wrote to memory of 2596 2848 E33E.tmp 36 PID 2848 wrote to memory of 2596 2848 E33E.tmp 36 PID 2848 wrote to memory of 2596 2848 E33E.tmp 36 PID 2848 wrote to memory of 2596 2848 E33E.tmp 36 PID 2596 wrote to memory of 2744 2596 E3AB.tmp 37 PID 2596 wrote to memory of 2744 2596 E3AB.tmp 37 PID 2596 wrote to memory of 2744 2596 E3AB.tmp 37 PID 2596 wrote to memory of 2744 2596 E3AB.tmp 37 PID 2744 wrote to memory of 2564 2744 E3F9.tmp 38 PID 2744 wrote to memory of 2564 2744 E3F9.tmp 38 PID 2744 wrote to memory of 2564 2744 E3F9.tmp 38 PID 2744 wrote to memory of 2564 2744 E3F9.tmp 38 PID 2564 wrote to memory of 2644 2564 E456.tmp 39 PID 2564 wrote to memory of 2644 2564 E456.tmp 39 PID 2564 wrote to memory of 2644 2564 E456.tmp 39 PID 2564 wrote to memory of 2644 2564 E456.tmp 39 PID 2644 wrote to memory of 2124 2644 E4B4.tmp 40 PID 2644 wrote to memory of 2124 2644 E4B4.tmp 40 PID 2644 wrote to memory of 2124 2644 E4B4.tmp 40 PID 2644 wrote to memory of 2124 2644 E4B4.tmp 40 PID 2124 wrote to memory of 264 2124 E531.tmp 41 PID 2124 wrote to memory of 264 2124 E531.tmp 41 PID 2124 wrote to memory of 264 2124 E531.tmp 41 PID 2124 wrote to memory of 264 2124 E531.tmp 41 PID 264 wrote to memory of 2968 264 E59E.tmp 42 PID 264 wrote to memory of 2968 264 E59E.tmp 42 PID 264 wrote to memory of 2968 264 E59E.tmp 42 PID 264 wrote to memory of 2968 264 E59E.tmp 42 PID 2968 wrote to memory of 2264 2968 E5FC.tmp 43 PID 2968 wrote to memory of 2264 2968 E5FC.tmp 43 PID 2968 wrote to memory of 2264 2968 E5FC.tmp 43 PID 2968 wrote to memory of 2264 2968 E5FC.tmp 43 PID 2264 wrote to memory of 2000 2264 E669.tmp 44 PID 2264 wrote to memory of 2000 2264 E669.tmp 44 PID 2264 wrote to memory of 2000 2264 E669.tmp 44 PID 2264 wrote to memory of 2000 2264 E669.tmp 44 PID 2000 wrote to memory of 1920 2000 E6C6.tmp 45 PID 2000 wrote to memory of 1920 2000 E6C6.tmp 45 PID 2000 wrote to memory of 1920 2000 E6C6.tmp 45 PID 2000 wrote to memory of 1920 2000 E6C6.tmp 45 PID 1920 wrote to memory of 1424 1920 E734.tmp 46 PID 1920 wrote to memory of 1424 1920 E734.tmp 46 PID 1920 wrote to memory of 1424 1920 E734.tmp 46 PID 1920 wrote to memory of 1424 1920 E734.tmp 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-14_cca27a7944ab343957631f54cdfdd95b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\E206.tmp"C:\Users\Admin\AppData\Local\Temp\E206.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\E282.tmp"C:\Users\Admin\AppData\Local\Temp\E282.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"C:\Users\Admin\AppData\Local\Temp\E2F0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\E33E.tmp"C:\Users\Admin\AppData\Local\Temp\E33E.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"C:\Users\Admin\AppData\Local\Temp\E3AB.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"C:\Users\Admin\AppData\Local\Temp\E3F9.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\E456.tmp"C:\Users\Admin\AppData\Local\Temp\E456.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"C:\Users\Admin\AppData\Local\Temp\E4B4.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\E531.tmp"C:\Users\Admin\AppData\Local\Temp\E531.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\E59E.tmp"C:\Users\Admin\AppData\Local\Temp\E59E.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"C:\Users\Admin\AppData\Local\Temp\E5FC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\E669.tmp"C:\Users\Admin\AppData\Local\Temp\E669.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\E734.tmp"C:\Users\Admin\AppData\Local\Temp\E734.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\E791.tmp"C:\Users\Admin\AppData\Local\Temp\E791.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"C:\Users\Admin\AppData\Local\Temp\E7EF.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:836 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\E946.tmp"C:\Users\Admin\AppData\Local\Temp\E946.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:484 -
C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"C:\Users\Admin\AppData\Local\Temp\E9A4.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\EA11.tmp"C:\Users\Admin\AppData\Local\Temp\EA11.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"C:\Users\Admin\AppData\Local\Temp\EA5F.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"C:\Users\Admin\AppData\Local\Temp\EA9D.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\EADC.tmp"C:\Users\Admin\AppData\Local\Temp\EADC.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"C:\Users\Admin\AppData\Local\Temp\EB2A.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\EB68.tmp"C:\Users\Admin\AppData\Local\Temp\EB68.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"C:\Users\Admin\AppData\Local\Temp\EBB6.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"C:\Users\Admin\AppData\Local\Temp\EBF4.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\EC42.tmp"C:\Users\Admin\AppData\Local\Temp\EC42.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\EC81.tmp"C:\Users\Admin\AppData\Local\Temp\EC81.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"C:\Users\Admin\AppData\Local\Temp\ECCF.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"C:\Users\Admin\AppData\Local\Temp\ED0D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"C:\Users\Admin\AppData\Local\Temp\ED4C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"C:\Users\Admin\AppData\Local\Temp\ED8A.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"C:\Users\Admin\AppData\Local\Temp\EDC8.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:832 -
C:\Users\Admin\AppData\Local\Temp\EE07.tmp"C:\Users\Admin\AppData\Local\Temp\EE07.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\EE55.tmp"C:\Users\Admin\AppData\Local\Temp\EE55.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\EE93.tmp"C:\Users\Admin\AppData\Local\Temp\EE93.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"C:\Users\Admin\AppData\Local\Temp\EEE1.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"C:\Users\Admin\AppData\Local\Temp\EF2F.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"C:\Users\Admin\AppData\Local\Temp\EF6E.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"C:\Users\Admin\AppData\Local\Temp\EFAC.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"C:\Users\Admin\AppData\Local\Temp\EFEA.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:984 -
C:\Users\Admin\AppData\Local\Temp\F038.tmp"C:\Users\Admin\AppData\Local\Temp\F038.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\F077.tmp"C:\Users\Admin\AppData\Local\Temp\F077.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"C:\Users\Admin\AppData\Local\Temp\F0B5.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"C:\Users\Admin\AppData\Local\Temp\F0F4.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\F122.tmp"C:\Users\Admin\AppData\Local\Temp\F122.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:876 -
C:\Users\Admin\AppData\Local\Temp\F161.tmp"C:\Users\Admin\AppData\Local\Temp\F161.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\F19F.tmp"C:\Users\Admin\AppData\Local\Temp\F19F.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"C:\Users\Admin\AppData\Local\Temp\F1DE.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\F21C.tmp"C:\Users\Admin\AppData\Local\Temp\F21C.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\F26A.tmp"C:\Users\Admin\AppData\Local\Temp\F26A.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"C:\Users\Admin\AppData\Local\Temp\F2A8.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"C:\Users\Admin\AppData\Local\Temp\F2F6.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\F335.tmp"C:\Users\Admin\AppData\Local\Temp\F335.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:796 -
C:\Users\Admin\AppData\Local\Temp\F373.tmp"C:\Users\Admin\AppData\Local\Temp\F373.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"C:\Users\Admin\AppData\Local\Temp\F3B2.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"C:\Users\Admin\AppData\Local\Temp\F3F0.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\F42E.tmp"C:\Users\Admin\AppData\Local\Temp\F42E.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\F46D.tmp"C:\Users\Admin\AppData\Local\Temp\F46D.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"C:\Users\Admin\AppData\Local\Temp\F4CA.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\F509.tmp"C:\Users\Admin\AppData\Local\Temp\F509.tmp"65⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\F547.tmp"C:\Users\Admin\AppData\Local\Temp\F547.tmp"66⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"C:\Users\Admin\AppData\Local\Temp\F5A5.tmp"67⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"68⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\F622.tmp"C:\Users\Admin\AppData\Local\Temp\F622.tmp"69⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"70⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"C:\Users\Admin\AppData\Local\Temp\F6AE.tmp"71⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"C:\Users\Admin\AppData\Local\Temp\F6EC.tmp"72⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\F72B.tmp"C:\Users\Admin\AppData\Local\Temp\F72B.tmp"73⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\F769.tmp"C:\Users\Admin\AppData\Local\Temp\F769.tmp"74⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"C:\Users\Admin\AppData\Local\Temp\F7A8.tmp"75⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"C:\Users\Admin\AppData\Local\Temp\F7E6.tmp"76⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\F824.tmp"C:\Users\Admin\AppData\Local\Temp\F824.tmp"77⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\F863.tmp"C:\Users\Admin\AppData\Local\Temp\F863.tmp"78⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"C:\Users\Admin\AppData\Local\Temp\F8A1.tmp"79⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"C:\Users\Admin\AppData\Local\Temp\F8E0.tmp"80⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\F91E.tmp"C:\Users\Admin\AppData\Local\Temp\F91E.tmp"81⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\F95C.tmp"C:\Users\Admin\AppData\Local\Temp\F95C.tmp"82⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\F99B.tmp"C:\Users\Admin\AppData\Local\Temp\F99B.tmp"83⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"C:\Users\Admin\AppData\Local\Temp\F9D9.tmp"84⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\FA18.tmp"C:\Users\Admin\AppData\Local\Temp\FA18.tmp"85⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\FA56.tmp"C:\Users\Admin\AppData\Local\Temp\FA56.tmp"86⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\FA94.tmp"C:\Users\Admin\AppData\Local\Temp\FA94.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"C:\Users\Admin\AppData\Local\Temp\FAD3.tmp"88⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\FB11.tmp"C:\Users\Admin\AppData\Local\Temp\FB11.tmp"89⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\FB50.tmp"C:\Users\Admin\AppData\Local\Temp\FB50.tmp"90⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"C:\Users\Admin\AppData\Local\Temp\FB8E.tmp"91⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"C:\Users\Admin\AppData\Local\Temp\FBCC.tmp"92⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"C:\Users\Admin\AppData\Local\Temp\FC1A.tmp"93⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\FC59.tmp"C:\Users\Admin\AppData\Local\Temp\FC59.tmp"94⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"95⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"C:\Users\Admin\AppData\Local\Temp\FCD6.tmp"96⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\FD14.tmp"C:\Users\Admin\AppData\Local\Temp\FD14.tmp"97⤵PID:268
-
C:\Users\Admin\AppData\Local\Temp\FD52.tmp"C:\Users\Admin\AppData\Local\Temp\FD52.tmp"98⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\FD91.tmp"C:\Users\Admin\AppData\Local\Temp\FD91.tmp"99⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"C:\Users\Admin\AppData\Local\Temp\FDDF.tmp"100⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"C:\Users\Admin\AppData\Local\Temp\FE2D.tmp"101⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"C:\Users\Admin\AppData\Local\Temp\FE6B.tmp"102⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"C:\Users\Admin\AppData\Local\Temp\FEAA.tmp"103⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"C:\Users\Admin\AppData\Local\Temp\FEE8.tmp"104⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\FF26.tmp"C:\Users\Admin\AppData\Local\Temp\FF26.tmp"105⤵PID:1884
-
C:\Users\Admin\AppData\Local\Temp\FF65.tmp"C:\Users\Admin\AppData\Local\Temp\FF65.tmp"106⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"C:\Users\Admin\AppData\Local\Temp\FFA3.tmp"107⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"108⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3F.tmp"C:\Users\Admin\AppData\Local\Temp\3F.tmp"109⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7E.tmp"C:\Users\Admin\AppData\Local\Temp\7E.tmp"110⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\BC.tmp"C:\Users\Admin\AppData\Local\Temp\BC.tmp"111⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\FA.tmp"C:\Users\Admin\AppData\Local\Temp\FA.tmp"112⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\148.tmp"C:\Users\Admin\AppData\Local\Temp\148.tmp"113⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\187.tmp"C:\Users\Admin\AppData\Local\Temp\187.tmp"114⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\1D5.tmp"C:\Users\Admin\AppData\Local\Temp\1D5.tmp"115⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"116⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\261.tmp"C:\Users\Admin\AppData\Local\Temp\261.tmp"117⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\2AF.tmp"C:\Users\Admin\AppData\Local\Temp\2AF.tmp"118⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\2EE.tmp"C:\Users\Admin\AppData\Local\Temp\2EE.tmp"119⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\32C.tmp"C:\Users\Admin\AppData\Local\Temp\32C.tmp"120⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"121⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\3A9.tmp"C:\Users\Admin\AppData\Local\Temp\3A9.tmp"122⤵PID:2852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-