Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/09/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe
-
Size
765KB
-
MD5
4a167f9cb1ed12054734cb1bb5efd037
-
SHA1
a30565fa0fbebb227c9842c29552609b39055f73
-
SHA256
3d792707f36f11d415d7e53f6ecc044e8f6d03824b81804ab754d282966e81f7
-
SHA512
51b4d506d4a92758dcb25916e5496308506f53ac3d1516274c80f9f1fc7ab2621b53dba17027d1b29166aad6ed5dc3ebcd31229b936cb8d8863514e929b97448
-
SSDEEP
12288:ZU5rCOTeiDRcZz23RwEQKz7fS5iNgRd3ZF5rn5rLOa54U5w5A:ZUQOJDRcZ6RQca5igz3vh5Oa+UOS
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4476 6D21.tmp 4560 6D9E.tmp 4976 6E1B.tmp 1876 6ED7.tmp 2376 6F35.tmp 3372 6F92.tmp 1388 701F.tmp 4140 708C.tmp 2948 7109.tmp 3612 7167.tmp 784 71D4.tmp 452 7223.tmp 1436 7280.tmp 2812 72EE.tmp 1792 734B.tmp 3228 73A9.tmp 4288 7417.tmp 4612 7484.tmp 4380 74E2.tmp 4220 755F.tmp 2172 75BC.tmp 2200 761A.tmp 1116 76A7.tmp 2332 7705.tmp 3280 7762.tmp 3204 77C0.tmp 3456 782D.tmp 2740 78BA.tmp 4528 7937.tmp 2464 79A4.tmp 2176 7A02.tmp 1632 7A7F.tmp 4460 7AED.tmp 3584 7B4A.tmp 2848 7BC7.tmp 3036 7C15.tmp 5028 7C73.tmp 3472 7CC1.tmp 460 7D1F.tmp 4628 7D6D.tmp 4500 7DBB.tmp 1388 7E19.tmp 1300 7E67.tmp 1364 7EC5.tmp 3104 7F23.tmp 3444 7F80.tmp 64 7FDE.tmp 316 802C.tmp 2296 807A.tmp 1760 80C9.tmp 3452 8126.tmp 4048 8184.tmp 3388 81F1.tmp 3184 8240.tmp 640 828E.tmp 3400 82DC.tmp 3392 833A.tmp 3668 8397.tmp 4052 83F5.tmp 4128 8443.tmp 4272 84A1.tmp 1312 84FF.tmp 2168 855C.tmp 984 85BA.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 76A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 269E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B977.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2093.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6136.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B14A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78BA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2A28.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8FBD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7B3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E84D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 904.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AF89.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F53D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B53.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C12D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 98C0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EEB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B391.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E2CE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FDD8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1E41.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2769.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9640.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96A2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1A59.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6906.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B333.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EAAE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9848.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C2E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB4F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 833A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9A4C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A2B8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3321.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C147.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B73A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 4476 2628 2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe 83 PID 2628 wrote to memory of 4476 2628 2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe 83 PID 2628 wrote to memory of 4476 2628 2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe 83 PID 4476 wrote to memory of 4560 4476 6D21.tmp 84 PID 4476 wrote to memory of 4560 4476 6D21.tmp 84 PID 4476 wrote to memory of 4560 4476 6D21.tmp 84 PID 4560 wrote to memory of 4976 4560 6D9E.tmp 87 PID 4560 wrote to memory of 4976 4560 6D9E.tmp 87 PID 4560 wrote to memory of 4976 4560 6D9E.tmp 87 PID 4976 wrote to memory of 1876 4976 6E1B.tmp 88 PID 4976 wrote to memory of 1876 4976 6E1B.tmp 88 PID 4976 wrote to memory of 1876 4976 6E1B.tmp 88 PID 1876 wrote to memory of 2376 1876 6ED7.tmp 90 PID 1876 wrote to memory of 2376 1876 6ED7.tmp 90 PID 1876 wrote to memory of 2376 1876 6ED7.tmp 90 PID 2376 wrote to memory of 3372 2376 6F35.tmp 91 PID 2376 wrote to memory of 3372 2376 6F35.tmp 91 PID 2376 wrote to memory of 3372 2376 6F35.tmp 91 PID 3372 wrote to memory of 1388 3372 6F92.tmp 92 PID 3372 wrote to memory of 1388 3372 6F92.tmp 92 PID 3372 wrote to memory of 1388 3372 6F92.tmp 92 PID 1388 wrote to memory of 4140 1388 701F.tmp 93 PID 1388 wrote to memory of 4140 1388 701F.tmp 93 PID 1388 wrote to memory of 4140 1388 701F.tmp 93 PID 4140 wrote to memory of 2948 4140 708C.tmp 94 PID 4140 wrote to memory of 2948 4140 708C.tmp 94 PID 4140 wrote to memory of 2948 4140 708C.tmp 94 PID 2948 wrote to memory of 3612 2948 7109.tmp 95 PID 2948 wrote to memory of 3612 2948 7109.tmp 95 PID 2948 wrote to memory of 3612 2948 7109.tmp 95 PID 3612 wrote to memory of 784 3612 7167.tmp 96 PID 3612 wrote to memory of 784 3612 7167.tmp 96 PID 3612 wrote to memory of 784 3612 7167.tmp 96 PID 784 wrote to memory of 452 784 71D4.tmp 97 PID 784 wrote to memory of 452 784 71D4.tmp 97 PID 784 wrote to memory of 452 784 71D4.tmp 97 PID 452 wrote to memory of 1436 452 7223.tmp 98 PID 452 wrote to memory of 1436 452 7223.tmp 98 PID 452 wrote to memory of 1436 452 7223.tmp 98 PID 1436 wrote to memory of 2812 1436 7280.tmp 99 PID 1436 wrote to memory of 2812 1436 7280.tmp 99 PID 1436 wrote to memory of 2812 1436 7280.tmp 99 PID 2812 wrote to memory of 1792 2812 72EE.tmp 100 PID 2812 wrote to memory of 1792 2812 72EE.tmp 100 PID 2812 wrote to memory of 1792 2812 72EE.tmp 100 PID 1792 wrote to memory of 3228 1792 734B.tmp 101 PID 1792 wrote to memory of 3228 1792 734B.tmp 101 PID 1792 wrote to memory of 3228 1792 734B.tmp 101 PID 3228 wrote to memory of 4288 3228 73A9.tmp 102 PID 3228 wrote to memory of 4288 3228 73A9.tmp 102 PID 3228 wrote to memory of 4288 3228 73A9.tmp 102 PID 4288 wrote to memory of 4612 4288 7417.tmp 103 PID 4288 wrote to memory of 4612 4288 7417.tmp 103 PID 4288 wrote to memory of 4612 4288 7417.tmp 103 PID 4612 wrote to memory of 4380 4612 7484.tmp 104 PID 4612 wrote to memory of 4380 4612 7484.tmp 104 PID 4612 wrote to memory of 4380 4612 7484.tmp 104 PID 4380 wrote to memory of 4220 4380 74E2.tmp 106 PID 4380 wrote to memory of 4220 4380 74E2.tmp 106 PID 4380 wrote to memory of 4220 4380 74E2.tmp 106 PID 4220 wrote to memory of 2172 4220 755F.tmp 107 PID 4220 wrote to memory of 2172 4220 755F.tmp 107 PID 4220 wrote to memory of 2172 4220 755F.tmp 107 PID 2172 wrote to memory of 2200 2172 75BC.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-05_4a167f9cb1ed12054734cb1bb5efd037_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\734B.tmp"C:\Users\Admin\AppData\Local\Temp\734B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"23⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"25⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"26⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"27⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\782D.tmp"C:\Users\Admin\AppData\Local\Temp\782D.tmp"28⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"30⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\79A4.tmp"C:\Users\Admin\AppData\Local\Temp\79A4.tmp"31⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"32⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"33⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\7AED.tmp"C:\Users\Admin\AppData\Local\Temp\7AED.tmp"34⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"C:\Users\Admin\AppData\Local\Temp\7B4A.tmp"35⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"36⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"37⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"38⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"C:\Users\Admin\AppData\Local\Temp\7CC1.tmp"39⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"40⤵
- Executes dropped EXE
PID:460 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"41⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"C:\Users\Admin\AppData\Local\Temp\7DBB.tmp"42⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"43⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"44⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"45⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"46⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"47⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"48⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"49⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\807A.tmp"C:\Users\Admin\AppData\Local\Temp\807A.tmp"50⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"51⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"52⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"53⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"54⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"55⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"56⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"57⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"58⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"59⤵
- Executes dropped EXE
PID:3668 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"60⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"61⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"62⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"63⤵
- Executes dropped EXE
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"64⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"65⤵
- Executes dropped EXE
PID:984 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"66⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"67⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"68⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"69⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"70⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"71⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\883B.tmp"C:\Users\Admin\AppData\Local\Temp\883B.tmp"72⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\8899.tmp"C:\Users\Admin\AppData\Local\Temp\8899.tmp"73⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"74⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"75⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"76⤵PID:4156
-
C:\Users\Admin\AppData\Local\Temp\8A10.tmp"C:\Users\Admin\AppData\Local\Temp\8A10.tmp"77⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"78⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"C:\Users\Admin\AppData\Local\Temp\8ACB.tmp"79⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"80⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"81⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"82⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"83⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"84⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"85⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"86⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"87⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"88⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\8E55.tmp"C:\Users\Admin\AppData\Local\Temp\8E55.tmp"89⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"90⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"91⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"92⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"93⤵
- System Location Discovery: System Language Discovery
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"94⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"95⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\90C6.tmp"C:\Users\Admin\AppData\Local\Temp\90C6.tmp"96⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"97⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"98⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"99⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"100⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"101⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"102⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"103⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"104⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"105⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"106⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"107⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"108⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"109⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"110⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"111⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"112⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"113⤵
- System Location Discovery: System Language Discovery
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\96F0.tmp"C:\Users\Admin\AppData\Local\Temp\96F0.tmp"114⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"115⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\979C.tmp"C:\Users\Admin\AppData\Local\Temp\979C.tmp"116⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"117⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\9848.tmp"C:\Users\Admin\AppData\Local\Temp\9848.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"119⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\98F4.tmp"C:\Users\Admin\AppData\Local\Temp\98F4.tmp"120⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"121⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"122⤵PID:2364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-