Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
25/03/2025, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe
-
Size
520KB
-
MD5
6b8879d77f4c869fd020909e408f16d7
-
SHA1
b083757b3ba457ba75e0c2aa480ec9ec2e767241
-
SHA256
2b5bc55f966fc68633778f6826d4d34a37841d72a30ceb18de72c694381998f2
-
SHA512
09ea75144c91cb33787baeff3c0f21f7cc4096c6809ea2ce816a804e4f4f0b8044711563ff9d41c1785efe0e02ec51a5af9472fbd72e4afd209798e6acda3885
-
SSDEEP
12288:roRXOQjmOyS2FAR+tJUKybbI88+aWpQVeJNZ:rogQ9yxFy04QxGRN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3008 F067.tmp 792 F0E4.tmp 2952 F1FD.tmp 2948 F2E7.tmp 2940 F41F.tmp 2760 F557.tmp 828 F660.tmp 3024 F75A.tmp 2784 F872.tmp 2592 F96C.tmp 2572 FA75.tmp 1668 FB7E.tmp 2672 FC97.tmp 884 FDB0.tmp 2356 FED8.tmp 3052 FFE2.tmp 2168 EB.tmp 2192 1A6.tmp 2336 36A.tmp 2636 52F.tmp 3032 648.tmp 1140 741.tmp 1920 81C.tmp 2204 8C7.tmp 2908 944.tmp 2064 9C1.tmp 2104 A4D.tmp 2108 ADA.tmp 2076 B76.tmp 572 C12.tmp 1148 C8E.tmp 616 D1B.tmp 1004 DA7.tmp 1792 E34.tmp 2988 EB0.tmp 1304 F3D.tmp 2700 FBA.tmp 1532 1065.tmp 1912 1111.tmp 1652 11BC.tmp 1016 1249.tmp 2096 12D5.tmp 1992 1362.tmp 2484 13FE.tmp 432 148A.tmp 1984 1516.tmp 2340 15A3.tmp 1488 1620.tmp 740 16BC.tmp 2232 1748.tmp 1720 17D4.tmp 1608 1A64.tmp 2836 1AE0.tmp 2872 1B6D.tmp 2972 1BF9.tmp 2876 1C76.tmp 2852 1D12.tmp 2880 1DBE.tmp 2940 1E4A.tmp 2136 1EE6.tmp 2760 1F72.tmp 2780 200E.tmp 2720 207C.tmp 3024 2108.tmp -
Loads dropped DLL 64 IoCs
pid Process 1820 2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe 3008 F067.tmp 792 F0E4.tmp 2952 F1FD.tmp 2948 F2E7.tmp 2940 F41F.tmp 2760 F557.tmp 828 F660.tmp 3024 F75A.tmp 2784 F872.tmp 2592 F96C.tmp 2572 FA75.tmp 1668 FB7E.tmp 2672 FC97.tmp 884 FDB0.tmp 2356 FED8.tmp 3052 FFE2.tmp 2168 EB.tmp 2192 1A6.tmp 2336 36A.tmp 2636 52F.tmp 3032 648.tmp 1140 741.tmp 1920 81C.tmp 2204 8C7.tmp 2908 944.tmp 2064 9C1.tmp 2104 A4D.tmp 2108 ADA.tmp 2076 B76.tmp 572 C12.tmp 1148 C8E.tmp 616 D1B.tmp 1004 DA7.tmp 1792 E34.tmp 2988 EB0.tmp 1304 F3D.tmp 2700 FBA.tmp 1532 1065.tmp 1912 1111.tmp 1652 11BC.tmp 1016 1249.tmp 2096 12D5.tmp 1992 1362.tmp 2484 13FE.tmp 432 148A.tmp 1984 1516.tmp 2340 15A3.tmp 1488 1620.tmp 740 16BC.tmp 2232 1748.tmp 2820 194B.tmp 1608 1A64.tmp 2836 1AE0.tmp 2872 1B6D.tmp 2972 1BF9.tmp 2876 1C76.tmp 2852 1D12.tmp 2880 1DBE.tmp 2940 1E4A.tmp 2136 1EE6.tmp 2760 1F72.tmp 2780 200E.tmp 2720 207C.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7224.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 906D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA43.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B54B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5BB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A11F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DAA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB5C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6825.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E87B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3C1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 36F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 951E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B960.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB0C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DE9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3A15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 511D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF26.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3D9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AA7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F872.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E9B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A92.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E292.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B432.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4911.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CFDD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F00A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF81.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1111.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 10D2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7DC7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A9C7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7C90.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE47.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 71D6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B3B5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F2A8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 11EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8AD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D70E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA87.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 478B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D568.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1820 wrote to memory of 3008 1820 2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe 29 PID 1820 wrote to memory of 3008 1820 2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe 29 PID 1820 wrote to memory of 3008 1820 2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe 29 PID 1820 wrote to memory of 3008 1820 2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe 29 PID 3008 wrote to memory of 792 3008 F067.tmp 30 PID 3008 wrote to memory of 792 3008 F067.tmp 30 PID 3008 wrote to memory of 792 3008 F067.tmp 30 PID 3008 wrote to memory of 792 3008 F067.tmp 30 PID 792 wrote to memory of 2952 792 F0E4.tmp 31 PID 792 wrote to memory of 2952 792 F0E4.tmp 31 PID 792 wrote to memory of 2952 792 F0E4.tmp 31 PID 792 wrote to memory of 2952 792 F0E4.tmp 31 PID 2952 wrote to memory of 2948 2952 F1FD.tmp 32 PID 2952 wrote to memory of 2948 2952 F1FD.tmp 32 PID 2952 wrote to memory of 2948 2952 F1FD.tmp 32 PID 2952 wrote to memory of 2948 2952 F1FD.tmp 32 PID 2948 wrote to memory of 2940 2948 F2E7.tmp 33 PID 2948 wrote to memory of 2940 2948 F2E7.tmp 33 PID 2948 wrote to memory of 2940 2948 F2E7.tmp 33 PID 2948 wrote to memory of 2940 2948 F2E7.tmp 33 PID 2940 wrote to memory of 2760 2940 F41F.tmp 34 PID 2940 wrote to memory of 2760 2940 F41F.tmp 34 PID 2940 wrote to memory of 2760 2940 F41F.tmp 34 PID 2940 wrote to memory of 2760 2940 F41F.tmp 34 PID 2760 wrote to memory of 828 2760 F557.tmp 35 PID 2760 wrote to memory of 828 2760 F557.tmp 35 PID 2760 wrote to memory of 828 2760 F557.tmp 35 PID 2760 wrote to memory of 828 2760 F557.tmp 35 PID 828 wrote to memory of 3024 828 F660.tmp 36 PID 828 wrote to memory of 3024 828 F660.tmp 36 PID 828 wrote to memory of 3024 828 F660.tmp 36 PID 828 wrote to memory of 3024 828 F660.tmp 36 PID 3024 wrote to memory of 2784 3024 F75A.tmp 37 PID 3024 wrote to memory of 2784 3024 F75A.tmp 37 PID 3024 wrote to memory of 2784 3024 F75A.tmp 37 PID 3024 wrote to memory of 2784 3024 F75A.tmp 37 PID 2784 wrote to memory of 2592 2784 F872.tmp 38 PID 2784 wrote to memory of 2592 2784 F872.tmp 38 PID 2784 wrote to memory of 2592 2784 F872.tmp 38 PID 2784 wrote to memory of 2592 2784 F872.tmp 38 PID 2592 wrote to memory of 2572 2592 F96C.tmp 39 PID 2592 wrote to memory of 2572 2592 F96C.tmp 39 PID 2592 wrote to memory of 2572 2592 F96C.tmp 39 PID 2592 wrote to memory of 2572 2592 F96C.tmp 39 PID 2572 wrote to memory of 1668 2572 FA75.tmp 40 PID 2572 wrote to memory of 1668 2572 FA75.tmp 40 PID 2572 wrote to memory of 1668 2572 FA75.tmp 40 PID 2572 wrote to memory of 1668 2572 FA75.tmp 40 PID 1668 wrote to memory of 2672 1668 FB7E.tmp 41 PID 1668 wrote to memory of 2672 1668 FB7E.tmp 41 PID 1668 wrote to memory of 2672 1668 FB7E.tmp 41 PID 1668 wrote to memory of 2672 1668 FB7E.tmp 41 PID 2672 wrote to memory of 884 2672 FC97.tmp 42 PID 2672 wrote to memory of 884 2672 FC97.tmp 42 PID 2672 wrote to memory of 884 2672 FC97.tmp 42 PID 2672 wrote to memory of 884 2672 FC97.tmp 42 PID 884 wrote to memory of 2356 884 FDB0.tmp 43 PID 884 wrote to memory of 2356 884 FDB0.tmp 43 PID 884 wrote to memory of 2356 884 FDB0.tmp 43 PID 884 wrote to memory of 2356 884 FDB0.tmp 43 PID 2356 wrote to memory of 3052 2356 FED8.tmp 44 PID 2356 wrote to memory of 3052 2356 FED8.tmp 44 PID 2356 wrote to memory of 3052 2356 FED8.tmp 44 PID 2356 wrote to memory of 3052 2356 FED8.tmp 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-25_6b8879d77f4c869fd020909e408f16d7_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\F067.tmp"C:\Users\Admin\AppData\Local\Temp\F067.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"C:\Users\Admin\AppData\Local\Temp\F0E4.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"C:\Users\Admin\AppData\Local\Temp\F1FD.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"C:\Users\Admin\AppData\Local\Temp\F2E7.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\F41F.tmp"C:\Users\Admin\AppData\Local\Temp\F41F.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\F557.tmp"C:\Users\Admin\AppData\Local\Temp\F557.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\F660.tmp"C:\Users\Admin\AppData\Local\Temp\F660.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\F75A.tmp"C:\Users\Admin\AppData\Local\Temp\F75A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\F872.tmp"C:\Users\Admin\AppData\Local\Temp\F872.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\F96C.tmp"C:\Users\Admin\AppData\Local\Temp\F96C.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\FA75.tmp"C:\Users\Admin\AppData\Local\Temp\FA75.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"C:\Users\Admin\AppData\Local\Temp\FB7E.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\FC97.tmp"C:\Users\Admin\AppData\Local\Temp\FC97.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"C:\Users\Admin\AppData\Local\Temp\FDB0.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\FED8.tmp"C:\Users\Admin\AppData\Local\Temp\FED8.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"C:\Users\Admin\AppData\Local\Temp\FFE2.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\EB.tmp"C:\Users\Admin\AppData\Local\Temp\EB.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\1A6.tmp"C:\Users\Admin\AppData\Local\Temp\1A6.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\36A.tmp"C:\Users\Admin\AppData\Local\Temp\36A.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\52F.tmp"C:\Users\Admin\AppData\Local\Temp\52F.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\648.tmp"C:\Users\Admin\AppData\Local\Temp\648.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\741.tmp"C:\Users\Admin\AppData\Local\Temp\741.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\81C.tmp"C:\Users\Admin\AppData\Local\Temp\81C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\8C7.tmp"C:\Users\Admin\AppData\Local\Temp\8C7.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\9C1.tmp"C:\Users\Admin\AppData\Local\Temp\9C1.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\A4D.tmp"C:\Users\Admin\AppData\Local\Temp\A4D.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\ADA.tmp"C:\Users\Admin\AppData\Local\Temp\ADA.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\B76.tmp"C:\Users\Admin\AppData\Local\Temp\B76.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\C12.tmp"C:\Users\Admin\AppData\Local\Temp\C12.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:572 -
C:\Users\Admin\AppData\Local\Temp\C8E.tmp"C:\Users\Admin\AppData\Local\Temp\C8E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\EB0.tmp"C:\Users\Admin\AppData\Local\Temp\EB0.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1065.tmp"C:\Users\Admin\AppData\Local\Temp\1065.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1111.tmp"C:\Users\Admin\AppData\Local\Temp\1111.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1249.tmp"C:\Users\Admin\AppData\Local\Temp\1249.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\1362.tmp"C:\Users\Admin\AppData\Local\Temp\1362.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\148A.tmp"C:\Users\Admin\AppData\Local\Temp\148A.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:432 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\16BC.tmp"C:\Users\Admin\AppData\Local\Temp\16BC.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:740 -
C:\Users\Admin\AppData\Local\Temp\1748.tmp"C:\Users\Admin\AppData\Local\Temp\1748.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"52⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\194B.tmp"C:\Users\Admin\AppData\Local\Temp\194B.tmp"53⤵
- Loads dropped DLL
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"C:\Users\Admin\AppData\Local\Temp\1B6D.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"C:\Users\Admin\AppData\Local\Temp\1BF9.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\1C76.tmp"C:\Users\Admin\AppData\Local\Temp\1C76.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"C:\Users\Admin\AppData\Local\Temp\1DBE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"C:\Users\Admin\AppData\Local\Temp\1E4A.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\200E.tmp"C:\Users\Admin\AppData\Local\Temp\200E.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"65⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\2108.tmp"C:\Users\Admin\AppData\Local\Temp\2108.tmp"66⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\2194.tmp"C:\Users\Admin\AppData\Local\Temp\2194.tmp"67⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\2221.tmp"C:\Users\Admin\AppData\Local\Temp\2221.tmp"68⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\229E.tmp"C:\Users\Admin\AppData\Local\Temp\229E.tmp"69⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"70⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"71⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"72⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"73⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\255C.tmp"C:\Users\Admin\AppData\Local\Temp\255C.tmp"74⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"75⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\26A3.tmp"C:\Users\Admin\AppData\Local\Temp\26A3.tmp"76⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"77⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\279D.tmp"C:\Users\Admin\AppData\Local\Temp\279D.tmp"78⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\2829.tmp"C:\Users\Admin\AppData\Local\Temp\2829.tmp"79⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"80⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\2961.tmp"C:\Users\Admin\AppData\Local\Temp\2961.tmp"81⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"82⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"83⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"C:\Users\Admin\AppData\Local\Temp\2AD8.tmp"84⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"85⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"86⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"87⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"88⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\2E70.tmp"C:\Users\Admin\AppData\Local\Temp\2E70.tmp"89⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"C:\Users\Admin\AppData\Local\Temp\2F0C.tmp"90⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"91⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3034.tmp"C:\Users\Admin\AppData\Local\Temp\3034.tmp"92⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"93⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\316C.tmp"C:\Users\Admin\AppData\Local\Temp\316C.tmp"94⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\3218.tmp"C:\Users\Admin\AppData\Local\Temp\3218.tmp"95⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3295.tmp"C:\Users\Admin\AppData\Local\Temp\3295.tmp"96⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3331.tmp"C:\Users\Admin\AppData\Local\Temp\3331.tmp"97⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"98⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\3459.tmp"C:\Users\Admin\AppData\Local\Temp\3459.tmp"99⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\34F5.tmp"C:\Users\Admin\AppData\Local\Temp\34F5.tmp"100⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"101⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\35FE.tmp"C:\Users\Admin\AppData\Local\Temp\35FE.tmp"102⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"103⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\36D9.tmp"C:\Users\Admin\AppData\Local\Temp\36D9.tmp"104⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"105⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"106⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\387E.tmp"C:\Users\Admin\AppData\Local\Temp\387E.tmp"107⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\38FB.tmp"C:\Users\Admin\AppData\Local\Temp\38FB.tmp"108⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"109⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"110⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3A90.tmp"C:\Users\Admin\AppData\Local\Temp\3A90.tmp"111⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"C:\Users\Admin\AppData\Local\Temp\3B1D.tmp"112⤵PID:328
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"113⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\3C64.tmp"C:\Users\Admin\AppData\Local\Temp\3C64.tmp"114⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"C:\Users\Admin\AppData\Local\Temp\3CF1.tmp"115⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"C:\Users\Admin\AppData\Local\Temp\3D6E.tmp"116⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\3E29.tmp"C:\Users\Admin\AppData\Local\Temp\3E29.tmp"117⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"C:\Users\Admin\AppData\Local\Temp\3EE4.tmp"118⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\3F70.tmp"C:\Users\Admin\AppData\Local\Temp\3F70.tmp"119⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"C:\Users\Admin\AppData\Local\Temp\3FFD.tmp"120⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\40A8.tmp"C:\Users\Admin\AppData\Local\Temp\40A8.tmp"121⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\4144.tmp"C:\Users\Admin\AppData\Local\Temp\4144.tmp"122⤵PID:2732
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-