Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe
-
Size
487KB
-
MD5
4bc3b2b44ee8719b792c10354c5a1de4
-
SHA1
d8ad34e948d4252c9f8bd96b13cb6a8e302cf362
-
SHA256
5d45084a5861617481cf3b6d403aa54ffafcc8e37e43455fbaefb12f93d57ab8
-
SHA512
d4bf098217e203dd849b384990175423af049671de287c0d550d0288b9869dc42e58a200d7dd8a43f0fda95f37929d55a1a9547b26201ee5fdc5951bcd20605d
-
SSDEEP
12288:HU5rCOTeiJ4ki6sQcZyATpUIkL4Lev6NZ:HUQOJJvLiTpUIkLp6N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2024 6774.tmp 4996 6801.tmp 4352 686E.tmp 1572 690A.tmp 4800 6978.tmp 2740 69C6.tmp 3612 6A43.tmp 2584 6AB0.tmp 2712 6B0E.tmp 1880 6B7B.tmp 1964 6BE9.tmp 3524 6C37.tmp 1800 6C85.tmp 4876 6CD3.tmp 3908 6D41.tmp 1972 6D9E.tmp 3636 6DFC.tmp 4132 6E5A.tmp 3116 6ED7.tmp 2424 6F35.tmp 3944 6F92.tmp 968 700F.tmp 1564 706D.tmp 3712 70EA.tmp 4540 7167.tmp 4524 71F4.tmp 1076 7271.tmp 3648 72FD.tmp 4200 734B.tmp 216 73B9.tmp 2172 7426.tmp 4356 74A3.tmp 4928 7530.tmp 4512 757E.tmp 516 75CC.tmp 3892 761A.tmp 4080 7678.tmp 2084 76D6.tmp 4872 7724.tmp 2364 7782.tmp 4680 77FF.tmp 1452 784D.tmp 2348 789B.tmp 4376 78E9.tmp 2380 7937.tmp 4916 7985.tmp 3832 79D3.tmp 4556 7A21.tmp 324 7A70.tmp 4852 7ABE.tmp 876 7B1B.tmp 3624 7B6A.tmp 4352 7BC7.tmp 1420 7C25.tmp 3000 7C73.tmp 1944 7CC1.tmp 2740 7D1F.tmp 5000 7D7D.tmp 4764 7DCB.tmp 2584 7E19.tmp 3196 7E77.tmp 2520 7ED5.tmp 4848 7F32.tmp 3804 7F80.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 34E6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9AF8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A6B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ECA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1151.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30FE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4AB0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A74C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 15F4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 871D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A8A4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E465.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2EBC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3285.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4476.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A0B4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 26CD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3BFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C488.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3004.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 75F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ACB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CD62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C01.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2FF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E51.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4DEC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A246.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D9E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A46E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC58.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4F73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9DA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 500F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A940.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A41B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5080 wrote to memory of 2024 5080 2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe 85 PID 5080 wrote to memory of 2024 5080 2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe 85 PID 5080 wrote to memory of 2024 5080 2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe 85 PID 2024 wrote to memory of 4996 2024 6774.tmp 87 PID 2024 wrote to memory of 4996 2024 6774.tmp 87 PID 2024 wrote to memory of 4996 2024 6774.tmp 87 PID 4996 wrote to memory of 4352 4996 6801.tmp 88 PID 4996 wrote to memory of 4352 4996 6801.tmp 88 PID 4996 wrote to memory of 4352 4996 6801.tmp 88 PID 4352 wrote to memory of 1572 4352 686E.tmp 89 PID 4352 wrote to memory of 1572 4352 686E.tmp 89 PID 4352 wrote to memory of 1572 4352 686E.tmp 89 PID 1572 wrote to memory of 4800 1572 690A.tmp 90 PID 1572 wrote to memory of 4800 1572 690A.tmp 90 PID 1572 wrote to memory of 4800 1572 690A.tmp 90 PID 4800 wrote to memory of 2740 4800 6978.tmp 91 PID 4800 wrote to memory of 2740 4800 6978.tmp 91 PID 4800 wrote to memory of 2740 4800 6978.tmp 91 PID 2740 wrote to memory of 3612 2740 69C6.tmp 92 PID 2740 wrote to memory of 3612 2740 69C6.tmp 92 PID 2740 wrote to memory of 3612 2740 69C6.tmp 92 PID 3612 wrote to memory of 2584 3612 6A43.tmp 93 PID 3612 wrote to memory of 2584 3612 6A43.tmp 93 PID 3612 wrote to memory of 2584 3612 6A43.tmp 93 PID 2584 wrote to memory of 2712 2584 6AB0.tmp 94 PID 2584 wrote to memory of 2712 2584 6AB0.tmp 94 PID 2584 wrote to memory of 2712 2584 6AB0.tmp 94 PID 2712 wrote to memory of 1880 2712 6B0E.tmp 95 PID 2712 wrote to memory of 1880 2712 6B0E.tmp 95 PID 2712 wrote to memory of 1880 2712 6B0E.tmp 95 PID 1880 wrote to memory of 1964 1880 6B7B.tmp 96 PID 1880 wrote to memory of 1964 1880 6B7B.tmp 96 PID 1880 wrote to memory of 1964 1880 6B7B.tmp 96 PID 1964 wrote to memory of 3524 1964 6BE9.tmp 97 PID 1964 wrote to memory of 3524 1964 6BE9.tmp 97 PID 1964 wrote to memory of 3524 1964 6BE9.tmp 97 PID 3524 wrote to memory of 1800 3524 6C37.tmp 98 PID 3524 wrote to memory of 1800 3524 6C37.tmp 98 PID 3524 wrote to memory of 1800 3524 6C37.tmp 98 PID 1800 wrote to memory of 4876 1800 6C85.tmp 99 PID 1800 wrote to memory of 4876 1800 6C85.tmp 99 PID 1800 wrote to memory of 4876 1800 6C85.tmp 99 PID 4876 wrote to memory of 3908 4876 6CD3.tmp 100 PID 4876 wrote to memory of 3908 4876 6CD3.tmp 100 PID 4876 wrote to memory of 3908 4876 6CD3.tmp 100 PID 3908 wrote to memory of 1972 3908 6D41.tmp 101 PID 3908 wrote to memory of 1972 3908 6D41.tmp 101 PID 3908 wrote to memory of 1972 3908 6D41.tmp 101 PID 1972 wrote to memory of 3636 1972 6D9E.tmp 102 PID 1972 wrote to memory of 3636 1972 6D9E.tmp 102 PID 1972 wrote to memory of 3636 1972 6D9E.tmp 102 PID 3636 wrote to memory of 4132 3636 6DFC.tmp 103 PID 3636 wrote to memory of 4132 3636 6DFC.tmp 103 PID 3636 wrote to memory of 4132 3636 6DFC.tmp 103 PID 4132 wrote to memory of 3116 4132 6E5A.tmp 104 PID 4132 wrote to memory of 3116 4132 6E5A.tmp 104 PID 4132 wrote to memory of 3116 4132 6E5A.tmp 104 PID 3116 wrote to memory of 2424 3116 6ED7.tmp 105 PID 3116 wrote to memory of 2424 3116 6ED7.tmp 105 PID 3116 wrote to memory of 2424 3116 6ED7.tmp 105 PID 2424 wrote to memory of 3944 2424 6F35.tmp 106 PID 2424 wrote to memory of 3944 2424 6F35.tmp 106 PID 2424 wrote to memory of 3944 2424 6F35.tmp 106 PID 3944 wrote to memory of 968 3944 6F92.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_4bc3b2b44ee8719b792c10354c5a1de4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"23⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"24⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"25⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"26⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"27⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"28⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"29⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"30⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"31⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"32⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"33⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"34⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"35⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"36⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"37⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\7678.tmp"C:\Users\Admin\AppData\Local\Temp\7678.tmp"38⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"39⤵
- Executes dropped EXE
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7724.tmp"C:\Users\Admin\AppData\Local\Temp\7724.tmp"40⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"41⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"42⤵
- Executes dropped EXE
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"43⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"44⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"45⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"46⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"47⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"48⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"49⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7A70.tmp"C:\Users\Admin\AppData\Local\Temp\7A70.tmp"50⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"51⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"52⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"53⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"54⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"55⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"56⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"57⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"58⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"59⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"60⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"61⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\7E77.tmp"C:\Users\Admin\AppData\Local\Temp\7E77.tmp"62⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"63⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"64⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"65⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"66⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"67⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"68⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"69⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"70⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"71⤵PID:3324
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"72⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"73⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"74⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"75⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"76⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\8368.tmp"C:\Users\Admin\AppData\Local\Temp\8368.tmp"77⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"78⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"79⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"80⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"81⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"82⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\857C.tmp"C:\Users\Admin\AppData\Local\Temp\857C.tmp"83⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"84⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"85⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"86⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"87⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"88⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"89⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"90⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"91⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"92⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"93⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"94⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"95⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"96⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"97⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"98⤵
- System Location Discovery: System Language Discovery
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"99⤵
- System Location Discovery: System Language Discovery
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"100⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"101⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"102⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\8C04.tmp"C:\Users\Admin\AppData\Local\Temp\8C04.tmp"103⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"104⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"105⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"106⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"107⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"108⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"109⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"110⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"111⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"112⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"113⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"114⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"115⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\903A.tmp"C:\Users\Admin\AppData\Local\Temp\903A.tmp"116⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"117⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"118⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"119⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"120⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"121⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"122⤵PID:2456
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-