Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 10:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe
Resource
win10v2004-20240910-en
General
-
Target
2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe
-
Size
541KB
-
MD5
3ddf0fb14d73277d53d5e8c5bb67808b
-
SHA1
2d06c35757a18b1d89f12d8ef57fffacd6b97443
-
SHA256
ec38f7d29b6681921bbe6e3f590fd310d107ceaec6fabb570d4f00f092d3c8fb
-
SHA512
a24617a6db86d3b985b84a071f8c535429333fe2a6a3d45d394b2339d62945ab5c72300962885fe310eedc87457d133b78ca34672a4835edb0261ddd8ec44fb9
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLjD7POPd7XfFzURQmmIt/ndM4CPhFtoBL1igsH34:UU5rCOTeifi12SDi/24+h84rZa73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1980 C2D2.tmp 2000 C330.tmp 2500 C3AD.tmp 1712 C40A.tmp 688 C477.tmp 2168 C4D5.tmp 1904 C542.tmp 3008 C5AF.tmp 2800 C61D.tmp 2700 C68A.tmp 2852 C6E7.tmp 2764 C755.tmp 2848 C7C2.tmp 2576 C82F.tmp 2648 C89C.tmp 2624 C909.tmp 2636 C977.tmp 2664 C9C5.tmp 2836 CA32.tmp 1312 CA9F.tmp 2384 CAED.tmp 2036 CB5A.tmp 1908 CBB8.tmp 2140 CBF6.tmp 2980 CC35.tmp 2416 CC73.tmp 2528 CCB1.tmp 2208 CCF0.tmp 2672 CD2E.tmp 1196 CD6D.tmp 1056 CDAB.tmp 1076 CDE9.tmp 2480 CE28.tmp 2292 CE66.tmp 1932 CEA5.tmp 1320 CEE3.tmp 2432 CF21.tmp 296 CF60.tmp 1792 CF9E.tmp 1728 CFEC.tmp 852 D02B.tmp 568 D079.tmp 2712 D0B7.tmp 2064 D0F5.tmp 2992 D143.tmp 1740 D182.tmp 2448 D1C0.tmp 1480 D1FF.tmp 892 D23D.tmp 2364 D27B.tmp 300 D2C9.tmp 1604 D308.tmp 3056 D346.tmp 1996 D385.tmp 2088 D3C3.tmp 760 D401.tmp 356 D440.tmp 1988 D47E.tmp 1944 D4BD.tmp 2176 D4FB.tmp 796 D549.tmp 2240 D587.tmp 764 D5D5.tmp 2776 D623.tmp -
Loads dropped DLL 64 IoCs
pid Process 1812 2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe 1980 C2D2.tmp 2000 C330.tmp 2500 C3AD.tmp 1712 C40A.tmp 688 C477.tmp 2168 C4D5.tmp 1904 C542.tmp 3008 C5AF.tmp 2800 C61D.tmp 2700 C68A.tmp 2852 C6E7.tmp 2764 C755.tmp 2848 C7C2.tmp 2576 C82F.tmp 2648 C89C.tmp 2624 C909.tmp 2636 C977.tmp 2664 C9C5.tmp 2836 CA32.tmp 1312 CA9F.tmp 2384 CAED.tmp 2036 CB5A.tmp 1908 CBB8.tmp 2140 CBF6.tmp 2980 CC35.tmp 2416 CC73.tmp 2528 CCB1.tmp 2208 CCF0.tmp 2672 CD2E.tmp 1196 CD6D.tmp 1056 CDAB.tmp 1076 CDE9.tmp 2480 CE28.tmp 2292 CE66.tmp 1932 CEA5.tmp 1320 CEE3.tmp 2432 CF21.tmp 296 CF60.tmp 1792 CF9E.tmp 1728 CFEC.tmp 852 D02B.tmp 568 D079.tmp 2712 D0B7.tmp 2064 D0F5.tmp 2992 D143.tmp 1740 D182.tmp 2448 D1C0.tmp 1480 D1FF.tmp 892 D23D.tmp 2364 D27B.tmp 300 D2C9.tmp 1604 D308.tmp 3056 D346.tmp 1996 D385.tmp 2088 D3C3.tmp 760 D401.tmp 356 D440.tmp 1988 D47E.tmp 1944 D4BD.tmp 2176 D4FB.tmp 796 D549.tmp 2240 D587.tmp 764 D5D5.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6AB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECFE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E58E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BF7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54C4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F586.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C3C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BE6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9270.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AC9.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5216.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A8B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3FCE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5B1B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 271.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7974.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 39B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8F35.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B413.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 50DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7E15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1812 wrote to memory of 1980 1812 2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe 30 PID 1812 wrote to memory of 1980 1812 2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe 30 PID 1812 wrote to memory of 1980 1812 2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe 30 PID 1812 wrote to memory of 1980 1812 2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe 30 PID 1980 wrote to memory of 2000 1980 C2D2.tmp 31 PID 1980 wrote to memory of 2000 1980 C2D2.tmp 31 PID 1980 wrote to memory of 2000 1980 C2D2.tmp 31 PID 1980 wrote to memory of 2000 1980 C2D2.tmp 31 PID 2000 wrote to memory of 2500 2000 C330.tmp 32 PID 2000 wrote to memory of 2500 2000 C330.tmp 32 PID 2000 wrote to memory of 2500 2000 C330.tmp 32 PID 2000 wrote to memory of 2500 2000 C330.tmp 32 PID 2500 wrote to memory of 1712 2500 C3AD.tmp 33 PID 2500 wrote to memory of 1712 2500 C3AD.tmp 33 PID 2500 wrote to memory of 1712 2500 C3AD.tmp 33 PID 2500 wrote to memory of 1712 2500 C3AD.tmp 33 PID 1712 wrote to memory of 688 1712 C40A.tmp 34 PID 1712 wrote to memory of 688 1712 C40A.tmp 34 PID 1712 wrote to memory of 688 1712 C40A.tmp 34 PID 1712 wrote to memory of 688 1712 C40A.tmp 34 PID 688 wrote to memory of 2168 688 C477.tmp 35 PID 688 wrote to memory of 2168 688 C477.tmp 35 PID 688 wrote to memory of 2168 688 C477.tmp 35 PID 688 wrote to memory of 2168 688 C477.tmp 35 PID 2168 wrote to memory of 1904 2168 C4D5.tmp 36 PID 2168 wrote to memory of 1904 2168 C4D5.tmp 36 PID 2168 wrote to memory of 1904 2168 C4D5.tmp 36 PID 2168 wrote to memory of 1904 2168 C4D5.tmp 36 PID 1904 wrote to memory of 3008 1904 C542.tmp 37 PID 1904 wrote to memory of 3008 1904 C542.tmp 37 PID 1904 wrote to memory of 3008 1904 C542.tmp 37 PID 1904 wrote to memory of 3008 1904 C542.tmp 37 PID 3008 wrote to memory of 2800 3008 C5AF.tmp 38 PID 3008 wrote to memory of 2800 3008 C5AF.tmp 38 PID 3008 wrote to memory of 2800 3008 C5AF.tmp 38 PID 3008 wrote to memory of 2800 3008 C5AF.tmp 38 PID 2800 wrote to memory of 2700 2800 C61D.tmp 39 PID 2800 wrote to memory of 2700 2800 C61D.tmp 39 PID 2800 wrote to memory of 2700 2800 C61D.tmp 39 PID 2800 wrote to memory of 2700 2800 C61D.tmp 39 PID 2700 wrote to memory of 2852 2700 C68A.tmp 40 PID 2700 wrote to memory of 2852 2700 C68A.tmp 40 PID 2700 wrote to memory of 2852 2700 C68A.tmp 40 PID 2700 wrote to memory of 2852 2700 C68A.tmp 40 PID 2852 wrote to memory of 2764 2852 C6E7.tmp 41 PID 2852 wrote to memory of 2764 2852 C6E7.tmp 41 PID 2852 wrote to memory of 2764 2852 C6E7.tmp 41 PID 2852 wrote to memory of 2764 2852 C6E7.tmp 41 PID 2764 wrote to memory of 2848 2764 C755.tmp 42 PID 2764 wrote to memory of 2848 2764 C755.tmp 42 PID 2764 wrote to memory of 2848 2764 C755.tmp 42 PID 2764 wrote to memory of 2848 2764 C755.tmp 42 PID 2848 wrote to memory of 2576 2848 C7C2.tmp 43 PID 2848 wrote to memory of 2576 2848 C7C2.tmp 43 PID 2848 wrote to memory of 2576 2848 C7C2.tmp 43 PID 2848 wrote to memory of 2576 2848 C7C2.tmp 43 PID 2576 wrote to memory of 2648 2576 C82F.tmp 44 PID 2576 wrote to memory of 2648 2576 C82F.tmp 44 PID 2576 wrote to memory of 2648 2576 C82F.tmp 44 PID 2576 wrote to memory of 2648 2576 C82F.tmp 44 PID 2648 wrote to memory of 2624 2648 C89C.tmp 45 PID 2648 wrote to memory of 2624 2648 C89C.tmp 45 PID 2648 wrote to memory of 2624 2648 C89C.tmp 45 PID 2648 wrote to memory of 2624 2648 C89C.tmp 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-30_3ddf0fb14d73277d53d5e8c5bb67808b_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"C:\Users\Admin\AppData\Local\Temp\C2D2.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\C330.tmp"C:\Users\Admin\AppData\Local\Temp\C330.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"C:\Users\Admin\AppData\Local\Temp\C3AD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\C477.tmp"C:\Users\Admin\AppData\Local\Temp\C477.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"C:\Users\Admin\AppData\Local\Temp\C4D5.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\C542.tmp"C:\Users\Admin\AppData\Local\Temp\C542.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"C:\Users\Admin\AppData\Local\Temp\C5AF.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C61D.tmp"C:\Users\Admin\AppData\Local\Temp\C61D.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\C68A.tmp"C:\Users\Admin\AppData\Local\Temp\C68A.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"C:\Users\Admin\AppData\Local\Temp\C6E7.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\C755.tmp"C:\Users\Admin\AppData\Local\Temp\C755.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"C:\Users\Admin\AppData\Local\Temp\C7C2.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\C82F.tmp"C:\Users\Admin\AppData\Local\Temp\C82F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\C89C.tmp"C:\Users\Admin\AppData\Local\Temp\C89C.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\C909.tmp"C:\Users\Admin\AppData\Local\Temp\C909.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"C:\Users\Admin\AppData\Local\Temp\C9C5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\CA32.tmp"C:\Users\Admin\AppData\Local\Temp\CA32.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"C:\Users\Admin\AppData\Local\Temp\CA9F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\CAED.tmp"C:\Users\Admin\AppData\Local\Temp\CAED.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"C:\Users\Admin\AppData\Local\Temp\CB5A.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"C:\Users\Admin\AppData\Local\Temp\CBB8.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"C:\Users\Admin\AppData\Local\Temp\CBF6.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\CC35.tmp"C:\Users\Admin\AppData\Local\Temp\CC35.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\CC73.tmp"C:\Users\Admin\AppData\Local\Temp\CC73.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"C:\Users\Admin\AppData\Local\Temp\CCB1.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"C:\Users\Admin\AppData\Local\Temp\CCF0.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"C:\Users\Admin\AppData\Local\Temp\CD6D.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"C:\Users\Admin\AppData\Local\Temp\CDAB.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"C:\Users\Admin\AppData\Local\Temp\CDE9.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\CE28.tmp"C:\Users\Admin\AppData\Local\Temp\CE28.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\CE66.tmp"C:\Users\Admin\AppData\Local\Temp\CE66.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"C:\Users\Admin\AppData\Local\Temp\CEA5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"C:\Users\Admin\AppData\Local\Temp\CEE3.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\CF21.tmp"C:\Users\Admin\AppData\Local\Temp\CF21.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\CF60.tmp"C:\Users\Admin\AppData\Local\Temp\CF60.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:296 -
C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"C:\Users\Admin\AppData\Local\Temp\CF9E.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"C:\Users\Admin\AppData\Local\Temp\CFEC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D02B.tmp"C:\Users\Admin\AppData\Local\Temp\D02B.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\D079.tmp"C:\Users\Admin\AppData\Local\Temp\D079.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:568 -
C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"C:\Users\Admin\AppData\Local\Temp\D0B7.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"C:\Users\Admin\AppData\Local\Temp\D0F5.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\D143.tmp"C:\Users\Admin\AppData\Local\Temp\D143.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\D182.tmp"C:\Users\Admin\AppData\Local\Temp\D182.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"C:\Users\Admin\AppData\Local\Temp\D1C0.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"C:\Users\Admin\AppData\Local\Temp\D1FF.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\D23D.tmp"C:\Users\Admin\AppData\Local\Temp\D23D.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:892 -
C:\Users\Admin\AppData\Local\Temp\D27B.tmp"C:\Users\Admin\AppData\Local\Temp\D27B.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"C:\Users\Admin\AppData\Local\Temp\D2C9.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:300 -
C:\Users\Admin\AppData\Local\Temp\D308.tmp"C:\Users\Admin\AppData\Local\Temp\D308.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\D346.tmp"C:\Users\Admin\AppData\Local\Temp\D346.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\D385.tmp"C:\Users\Admin\AppData\Local\Temp\D385.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"C:\Users\Admin\AppData\Local\Temp\D3C3.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\D401.tmp"C:\Users\Admin\AppData\Local\Temp\D401.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:760 -
C:\Users\Admin\AppData\Local\Temp\D440.tmp"C:\Users\Admin\AppData\Local\Temp\D440.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:356 -
C:\Users\Admin\AppData\Local\Temp\D47E.tmp"C:\Users\Admin\AppData\Local\Temp\D47E.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"C:\Users\Admin\AppData\Local\Temp\D4BD.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"C:\Users\Admin\AppData\Local\Temp\D4FB.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\D549.tmp"C:\Users\Admin\AppData\Local\Temp\D549.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\D587.tmp"C:\Users\Admin\AppData\Local\Temp\D587.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"C:\Users\Admin\AppData\Local\Temp\D5D5.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:764 -
C:\Users\Admin\AppData\Local\Temp\D623.tmp"C:\Users\Admin\AppData\Local\Temp\D623.tmp"65⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\D662.tmp"C:\Users\Admin\AppData\Local\Temp\D662.tmp"66⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"C:\Users\Admin\AppData\Local\Temp\D6A0.tmp"67⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"C:\Users\Admin\AppData\Local\Temp\D6DF.tmp"68⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\D71D.tmp"C:\Users\Admin\AppData\Local\Temp\D71D.tmp"69⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\D75B.tmp"C:\Users\Admin\AppData\Local\Temp\D75B.tmp"70⤵PID:2756
-
C:\Users\Admin\AppData\Local\Temp\D79A.tmp"C:\Users\Admin\AppData\Local\Temp\D79A.tmp"71⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"C:\Users\Admin\AppData\Local\Temp\D7D8.tmp"72⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\D817.tmp"C:\Users\Admin\AppData\Local\Temp\D817.tmp"73⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\D855.tmp"C:\Users\Admin\AppData\Local\Temp\D855.tmp"74⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\D893.tmp"C:\Users\Admin\AppData\Local\Temp\D893.tmp"75⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"C:\Users\Admin\AppData\Local\Temp\D8E1.tmp"76⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\D920.tmp"C:\Users\Admin\AppData\Local\Temp\D920.tmp"77⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\D95E.tmp"C:\Users\Admin\AppData\Local\Temp\D95E.tmp"78⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\D99D.tmp"C:\Users\Admin\AppData\Local\Temp\D99D.tmp"79⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"C:\Users\Admin\AppData\Local\Temp\D9DB.tmp"80⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\DA19.tmp"C:\Users\Admin\AppData\Local\Temp\DA19.tmp"81⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\DA67.tmp"C:\Users\Admin\AppData\Local\Temp\DA67.tmp"82⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"C:\Users\Admin\AppData\Local\Temp\DAA6.tmp"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"C:\Users\Admin\AppData\Local\Temp\DAE4.tmp"84⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\DB23.tmp"C:\Users\Admin\AppData\Local\Temp\DB23.tmp"85⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\DB71.tmp"C:\Users\Admin\AppData\Local\Temp\DB71.tmp"86⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"C:\Users\Admin\AppData\Local\Temp\DBAF.tmp"87⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\DBED.tmp"C:\Users\Admin\AppData\Local\Temp\DBED.tmp"88⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"C:\Users\Admin\AppData\Local\Temp\DC2C.tmp"89⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"C:\Users\Admin\AppData\Local\Temp\DC6A.tmp"90⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"C:\Users\Admin\AppData\Local\Temp\DCA9.tmp"91⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"C:\Users\Admin\AppData\Local\Temp\DCE7.tmp"92⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\DD25.tmp"C:\Users\Admin\AppData\Local\Temp\DD25.tmp"93⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\DD64.tmp"C:\Users\Admin\AppData\Local\Temp\DD64.tmp"94⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"C:\Users\Admin\AppData\Local\Temp\DDA2.tmp"95⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"C:\Users\Admin\AppData\Local\Temp\DDE1.tmp"96⤵PID:288
-
C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"C:\Users\Admin\AppData\Local\Temp\DE2F.tmp"97⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"C:\Users\Admin\AppData\Local\Temp\DE6D.tmp"98⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"C:\Users\Admin\AppData\Local\Temp\DEAC.tmp"99⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"C:\Users\Admin\AppData\Local\Temp\DEEA.tmp"100⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\DF28.tmp"C:\Users\Admin\AppData\Local\Temp\DF28.tmp"101⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\DF67.tmp"C:\Users\Admin\AppData\Local\Temp\DF67.tmp"102⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"C:\Users\Admin\AppData\Local\Temp\DFA5.tmp"103⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"C:\Users\Admin\AppData\Local\Temp\DFE4.tmp"104⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\E022.tmp"C:\Users\Admin\AppData\Local\Temp\E022.tmp"105⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\E060.tmp"C:\Users\Admin\AppData\Local\Temp\E060.tmp"106⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\E09F.tmp"C:\Users\Admin\AppData\Local\Temp\E09F.tmp"107⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"C:\Users\Admin\AppData\Local\Temp\E0DD.tmp"108⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\E11C.tmp"C:\Users\Admin\AppData\Local\Temp\E11C.tmp"109⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\E15A.tmp"C:\Users\Admin\AppData\Local\Temp\E15A.tmp"110⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E198.tmp"C:\Users\Admin\AppData\Local\Temp\E198.tmp"111⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"C:\Users\Admin\AppData\Local\Temp\E1D7.tmp"112⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\E215.tmp"C:\Users\Admin\AppData\Local\Temp\E215.tmp"113⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\E254.tmp"C:\Users\Admin\AppData\Local\Temp\E254.tmp"114⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\E292.tmp"C:\Users\Admin\AppData\Local\Temp\E292.tmp"115⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"C:\Users\Admin\AppData\Local\Temp\E2D0.tmp"116⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\E30F.tmp"C:\Users\Admin\AppData\Local\Temp\E30F.tmp"117⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\E34D.tmp"C:\Users\Admin\AppData\Local\Temp\E34D.tmp"118⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\E38C.tmp"C:\Users\Admin\AppData\Local\Temp\E38C.tmp"119⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"C:\Users\Admin\AppData\Local\Temp\E3CA.tmp"120⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\E408.tmp"C:\Users\Admin\AppData\Local\Temp\E408.tmp"121⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\E447.tmp"C:\Users\Admin\AppData\Local\Temp\E447.tmp"122⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-