Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe
-
Size
712KB
-
MD5
04a53b34fba9a4f24beb797b94aa3175
-
SHA1
c3d1036df4fbbf99fc35c921c94ee41c7250b2c8
-
SHA256
08f42ae92562db2263d6d6e0a0a50469064e372ccf91285a4b8dd6933afbde90
-
SHA512
949966a2fd289a8b6ab5c6e5f0f82723f0b27c3e7f63ac604d71a8f6e426d39a4881909a53f1028cfcd07e41442d04d81a237d8f4a8fb28c0b48fe2613172fbe
-
SSDEEP
12288:FU5rCOTeiDNZ8FjILEfok8lEktGv5gBKJf/NZdCvq5TJLCvY90D8/LVBlVk736YI:FUQOJDNZ+jI4ArEktU6QnNnCvq5TJLC0
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2548 5A7F.tmp 3880 5B4A.tmp 4292 5D1F.tmp 3580 5E19.tmp 3976 5E96.tmp 1336 5F32.tmp 4112 5FBF.tmp 2028 603C.tmp 2704 60B9.tmp 4744 6155.tmp 3548 61E2.tmp 3288 629D.tmp 2504 6349.tmp 4128 6404.tmp 3876 64B0.tmp 4528 652D.tmp 1684 65D9.tmp 740 6656.tmp 2400 66E3.tmp 4708 6741.tmp 5052 67EC.tmp 4976 68A8.tmp 4356 6935.tmp 5028 69C1.tmp 468 6A4E.tmp 5008 6ACB.tmp 1184 6B96.tmp 2296 6C23.tmp 1884 6C90.tmp 1328 6D0D.tmp 764 6DA9.tmp 1992 6E36.tmp 3328 6EA3.tmp 4728 6F20.tmp 2832 6F8E.tmp 1980 6FEB.tmp 1916 7059.tmp 3796 70C6.tmp 680 7114.tmp 1832 7172.tmp 4396 71DF.tmp 4900 724D.tmp 4844 72BA.tmp 1056 7327.tmp 1684 7395.tmp 2528 7402.tmp 2144 7470.tmp 2720 74DD.tmp 3608 754A.tmp 5052 75A8.tmp 980 7615.tmp 2736 7683.tmp 4188 76F0.tmp 3184 775E.tmp 4124 77AC.tmp 3880 7819.tmp 1040 7886.tmp 4352 78E4.tmp 3600 7952.tmp 4796 79BF.tmp 3832 7A3C.tmp 2340 7A9A.tmp 5068 7AF7.tmp 3328 7B55.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5AE8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6C3D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2B4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FF5A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 188F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D220.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E700.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18ED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72A6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA2A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3956.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F315.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 29C5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E75D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4973.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA7D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3E09.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66A0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C50B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D16F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 894B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AAB2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA64.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8E2D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AEE4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 745B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 942D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 25DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8776.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A95.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CE19.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D5F8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4915.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4E93.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FEFC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 2548 964 2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe 90 PID 964 wrote to memory of 2548 964 2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe 90 PID 964 wrote to memory of 2548 964 2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe 90 PID 2548 wrote to memory of 3880 2548 5A7F.tmp 92 PID 2548 wrote to memory of 3880 2548 5A7F.tmp 92 PID 2548 wrote to memory of 3880 2548 5A7F.tmp 92 PID 3880 wrote to memory of 4292 3880 5B4A.tmp 94 PID 3880 wrote to memory of 4292 3880 5B4A.tmp 94 PID 3880 wrote to memory of 4292 3880 5B4A.tmp 94 PID 4292 wrote to memory of 3580 4292 5D1F.tmp 96 PID 4292 wrote to memory of 3580 4292 5D1F.tmp 96 PID 4292 wrote to memory of 3580 4292 5D1F.tmp 96 PID 3580 wrote to memory of 3976 3580 5E19.tmp 97 PID 3580 wrote to memory of 3976 3580 5E19.tmp 97 PID 3580 wrote to memory of 3976 3580 5E19.tmp 97 PID 3976 wrote to memory of 1336 3976 5E96.tmp 98 PID 3976 wrote to memory of 1336 3976 5E96.tmp 98 PID 3976 wrote to memory of 1336 3976 5E96.tmp 98 PID 1336 wrote to memory of 4112 1336 5F32.tmp 99 PID 1336 wrote to memory of 4112 1336 5F32.tmp 99 PID 1336 wrote to memory of 4112 1336 5F32.tmp 99 PID 4112 wrote to memory of 2028 4112 5FBF.tmp 100 PID 4112 wrote to memory of 2028 4112 5FBF.tmp 100 PID 4112 wrote to memory of 2028 4112 5FBF.tmp 100 PID 2028 wrote to memory of 2704 2028 603C.tmp 101 PID 2028 wrote to memory of 2704 2028 603C.tmp 101 PID 2028 wrote to memory of 2704 2028 603C.tmp 101 PID 2704 wrote to memory of 4744 2704 60B9.tmp 102 PID 2704 wrote to memory of 4744 2704 60B9.tmp 102 PID 2704 wrote to memory of 4744 2704 60B9.tmp 102 PID 4744 wrote to memory of 3548 4744 6155.tmp 104 PID 4744 wrote to memory of 3548 4744 6155.tmp 104 PID 4744 wrote to memory of 3548 4744 6155.tmp 104 PID 3548 wrote to memory of 3288 3548 61E2.tmp 105 PID 3548 wrote to memory of 3288 3548 61E2.tmp 105 PID 3548 wrote to memory of 3288 3548 61E2.tmp 105 PID 3288 wrote to memory of 2504 3288 629D.tmp 106 PID 3288 wrote to memory of 2504 3288 629D.tmp 106 PID 3288 wrote to memory of 2504 3288 629D.tmp 106 PID 2504 wrote to memory of 4128 2504 6349.tmp 107 PID 2504 wrote to memory of 4128 2504 6349.tmp 107 PID 2504 wrote to memory of 4128 2504 6349.tmp 107 PID 4128 wrote to memory of 3876 4128 6404.tmp 108 PID 4128 wrote to memory of 3876 4128 6404.tmp 108 PID 4128 wrote to memory of 3876 4128 6404.tmp 108 PID 3876 wrote to memory of 4528 3876 64B0.tmp 109 PID 3876 wrote to memory of 4528 3876 64B0.tmp 109 PID 3876 wrote to memory of 4528 3876 64B0.tmp 109 PID 4528 wrote to memory of 1684 4528 652D.tmp 110 PID 4528 wrote to memory of 1684 4528 652D.tmp 110 PID 4528 wrote to memory of 1684 4528 652D.tmp 110 PID 1684 wrote to memory of 740 1684 65D9.tmp 111 PID 1684 wrote to memory of 740 1684 65D9.tmp 111 PID 1684 wrote to memory of 740 1684 65D9.tmp 111 PID 740 wrote to memory of 2400 740 6656.tmp 112 PID 740 wrote to memory of 2400 740 6656.tmp 112 PID 740 wrote to memory of 2400 740 6656.tmp 112 PID 2400 wrote to memory of 4708 2400 66E3.tmp 113 PID 2400 wrote to memory of 4708 2400 66E3.tmp 113 PID 2400 wrote to memory of 4708 2400 66E3.tmp 113 PID 4708 wrote to memory of 5052 4708 6741.tmp 116 PID 4708 wrote to memory of 5052 4708 6741.tmp 116 PID 4708 wrote to memory of 5052 4708 6741.tmp 116 PID 5052 wrote to memory of 4976 5052 67EC.tmp 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_04a53b34fba9a4f24beb797b94aa3175_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"C:\Users\Admin\AppData\Local\Temp\5A7F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"C:\Users\Admin\AppData\Local\Temp\5B4A.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"C:\Users\Admin\AppData\Local\Temp\5D1F.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\5E19.tmp"C:\Users\Admin\AppData\Local\Temp\5E19.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\5E96.tmp"C:\Users\Admin\AppData\Local\Temp\5E96.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5F32.tmp"C:\Users\Admin\AppData\Local\Temp\5F32.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"C:\Users\Admin\AppData\Local\Temp\5FBF.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\603C.tmp"C:\Users\Admin\AppData\Local\Temp\603C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\60B9.tmp"C:\Users\Admin\AppData\Local\Temp\60B9.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\61E2.tmp"C:\Users\Admin\AppData\Local\Temp\61E2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\629D.tmp"C:\Users\Admin\AppData\Local\Temp\629D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\6349.tmp"C:\Users\Admin\AppData\Local\Temp\6349.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\64B0.tmp"C:\Users\Admin\AppData\Local\Temp\64B0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\652D.tmp"C:\Users\Admin\AppData\Local\Temp\652D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\65D9.tmp"C:\Users\Admin\AppData\Local\Temp\65D9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\6656.tmp"C:\Users\Admin\AppData\Local\Temp\6656.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\66E3.tmp"C:\Users\Admin\AppData\Local\Temp\66E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\6741.tmp"C:\Users\Admin\AppData\Local\Temp\6741.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\67EC.tmp"C:\Users\Admin\AppData\Local\Temp\67EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\68A8.tmp"C:\Users\Admin\AppData\Local\Temp\68A8.tmp"23⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6935.tmp"C:\Users\Admin\AppData\Local\Temp\6935.tmp"24⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\69C1.tmp"C:\Users\Admin\AppData\Local\Temp\69C1.tmp"25⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"C:\Users\Admin\AppData\Local\Temp\6A4E.tmp"26⤵
- Executes dropped EXE
PID:468 -
C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"C:\Users\Admin\AppData\Local\Temp\6ACB.tmp"27⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\6B96.tmp"C:\Users\Admin\AppData\Local\Temp\6B96.tmp"28⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\6C23.tmp"C:\Users\Admin\AppData\Local\Temp\6C23.tmp"29⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\6C90.tmp"C:\Users\Admin\AppData\Local\Temp\6C90.tmp"30⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"C:\Users\Admin\AppData\Local\Temp\6D0D.tmp"31⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"32⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\6E36.tmp"C:\Users\Admin\AppData\Local\Temp\6E36.tmp"33⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"C:\Users\Admin\AppData\Local\Temp\6EA3.tmp"34⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"35⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"C:\Users\Admin\AppData\Local\Temp\6F8E.tmp"36⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"C:\Users\Admin\AppData\Local\Temp\6FEB.tmp"37⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\7059.tmp"C:\Users\Admin\AppData\Local\Temp\7059.tmp"38⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\70C6.tmp"C:\Users\Admin\AppData\Local\Temp\70C6.tmp"39⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\7114.tmp"C:\Users\Admin\AppData\Local\Temp\7114.tmp"40⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\7172.tmp"C:\Users\Admin\AppData\Local\Temp\7172.tmp"41⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\71DF.tmp"C:\Users\Admin\AppData\Local\Temp\71DF.tmp"42⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\724D.tmp"C:\Users\Admin\AppData\Local\Temp\724D.tmp"43⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\72BA.tmp"C:\Users\Admin\AppData\Local\Temp\72BA.tmp"44⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"45⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\7395.tmp"C:\Users\Admin\AppData\Local\Temp\7395.tmp"46⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7402.tmp"C:\Users\Admin\AppData\Local\Temp\7402.tmp"47⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\7470.tmp"C:\Users\Admin\AppData\Local\Temp\7470.tmp"48⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\74DD.tmp"C:\Users\Admin\AppData\Local\Temp\74DD.tmp"49⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\754A.tmp"C:\Users\Admin\AppData\Local\Temp\754A.tmp"50⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\75A8.tmp"C:\Users\Admin\AppData\Local\Temp\75A8.tmp"51⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"52⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\7683.tmp"C:\Users\Admin\AppData\Local\Temp\7683.tmp"53⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\76F0.tmp"C:\Users\Admin\AppData\Local\Temp\76F0.tmp"54⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\775E.tmp"C:\Users\Admin\AppData\Local\Temp\775E.tmp"55⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\77AC.tmp"C:\Users\Admin\AppData\Local\Temp\77AC.tmp"56⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\7819.tmp"C:\Users\Admin\AppData\Local\Temp\7819.tmp"57⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"58⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\78E4.tmp"C:\Users\Admin\AppData\Local\Temp\78E4.tmp"59⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7952.tmp"C:\Users\Admin\AppData\Local\Temp\7952.tmp"60⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\79BF.tmp"C:\Users\Admin\AppData\Local\Temp\79BF.tmp"61⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"62⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"63⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"C:\Users\Admin\AppData\Local\Temp\7AF7.tmp"64⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\7B55.tmp"C:\Users\Admin\AppData\Local\Temp\7B55.tmp"65⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"C:\Users\Admin\AppData\Local\Temp\7BB3.tmp"66⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\7C11.tmp"C:\Users\Admin\AppData\Local\Temp\7C11.tmp"67⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"68⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"C:\Users\Admin\AppData\Local\Temp\7CCC.tmp"69⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"C:\Users\Admin\AppData\Local\Temp\7D1A.tmp"70⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\7D78.tmp"C:\Users\Admin\AppData\Local\Temp\7D78.tmp"71⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"C:\Users\Admin\AppData\Local\Temp\7DD6.tmp"72⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\7E43.tmp"C:\Users\Admin\AppData\Local\Temp\7E43.tmp"73⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"74⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"75⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"C:\Users\Admin\AppData\Local\Temp\7F6C.tmp"76⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"77⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\8037.tmp"C:\Users\Admin\AppData\Local\Temp\8037.tmp"78⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\8095.tmp"C:\Users\Admin\AppData\Local\Temp\8095.tmp"79⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\8102.tmp"C:\Users\Admin\AppData\Local\Temp\8102.tmp"80⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\8150.tmp"C:\Users\Admin\AppData\Local\Temp\8150.tmp"81⤵PID:184
-
C:\Users\Admin\AppData\Local\Temp\81BE.tmp"C:\Users\Admin\AppData\Local\Temp\81BE.tmp"82⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"83⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\826A.tmp"C:\Users\Admin\AppData\Local\Temp\826A.tmp"84⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\82C7.tmp"C:\Users\Admin\AppData\Local\Temp\82C7.tmp"85⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\8325.tmp"C:\Users\Admin\AppData\Local\Temp\8325.tmp"86⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\8393.tmp"C:\Users\Admin\AppData\Local\Temp\8393.tmp"87⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\83F0.tmp"C:\Users\Admin\AppData\Local\Temp\83F0.tmp"88⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\844E.tmp"C:\Users\Admin\AppData\Local\Temp\844E.tmp"89⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\849C.tmp"C:\Users\Admin\AppData\Local\Temp\849C.tmp"90⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\84EA.tmp"C:\Users\Admin\AppData\Local\Temp\84EA.tmp"91⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\8538.tmp"C:\Users\Admin\AppData\Local\Temp\8538.tmp"92⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\8587.tmp"C:\Users\Admin\AppData\Local\Temp\8587.tmp"93⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\85E4.tmp"C:\Users\Admin\AppData\Local\Temp\85E4.tmp"94⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\8652.tmp"C:\Users\Admin\AppData\Local\Temp\8652.tmp"95⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\86BF.tmp"C:\Users\Admin\AppData\Local\Temp\86BF.tmp"96⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\870D.tmp"C:\Users\Admin\AppData\Local\Temp\870D.tmp"97⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\876B.tmp"C:\Users\Admin\AppData\Local\Temp\876B.tmp"98⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\87C9.tmp"C:\Users\Admin\AppData\Local\Temp\87C9.tmp"99⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\8826.tmp"C:\Users\Admin\AppData\Local\Temp\8826.tmp"100⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"101⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\88F2.tmp"C:\Users\Admin\AppData\Local\Temp\88F2.tmp"102⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\894F.tmp"C:\Users\Admin\AppData\Local\Temp\894F.tmp"103⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\89AD.tmp"C:\Users\Admin\AppData\Local\Temp\89AD.tmp"104⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"105⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"106⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"C:\Users\Admin\AppData\Local\Temp\8AB7.tmp"107⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\8B05.tmp"C:\Users\Admin\AppData\Local\Temp\8B05.tmp"108⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\8B63.tmp"C:\Users\Admin\AppData\Local\Temp\8B63.tmp"109⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"C:\Users\Admin\AppData\Local\Temp\8BB1.tmp"110⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"C:\Users\Admin\AppData\Local\Temp\8BFF.tmp"111⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"112⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\8CAB.tmp"C:\Users\Admin\AppData\Local\Temp\8CAB.tmp"113⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\8D08.tmp"C:\Users\Admin\AppData\Local\Temp\8D08.tmp"114⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\8D66.tmp"C:\Users\Admin\AppData\Local\Temp\8D66.tmp"115⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"C:\Users\Admin\AppData\Local\Temp\8DC4.tmp"116⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\8E31.tmp"C:\Users\Admin\AppData\Local\Temp\8E31.tmp"117⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"C:\Users\Admin\AppData\Local\Temp\8E7F.tmp"118⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"119⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"C:\Users\Admin\AppData\Local\Temp\8F1C.tmp"120⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\8F79.tmp"C:\Users\Admin\AppData\Local\Temp\8F79.tmp"121⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"C:\Users\Admin\AppData\Local\Temp\8FD7.tmp"122⤵PID:4572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-