Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe
-
Size
536KB
-
MD5
10d8db4c56ff73b3878336838e9a77e4
-
SHA1
a499d5f74fba9af2d596b48ea4b12dc6f9371694
-
SHA256
8e06a9de561ee69bfefd116c3e273ea204e1321b91193940fcd2787b7be77193
-
SHA512
fee917d1e394b7f3a6ac695de2f1d7a6a62ff27d787ffa1aec77f40059d9c99c8c798079a952b950e781da58127aef23827c1ac27046546a08ee09e76b9c58b1
-
SSDEEP
12288:wU5rCOTeiUU1vgovWdcQ3wJTAl8it/UmIZxVJ0ZT9:wUQOJUUJpvWdv3Fl8gFIRJ0ZT9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4900 7908.tmp 4296 79D3.tmp 4864 7A50.tmp 1744 7ABE.tmp 2896 7B3B.tmp 3336 7BC7.tmp 1344 7C44.tmp 3688 7C92.tmp 3692 7D2F.tmp 2920 7DCB.tmp 220 7E58.tmp 2192 7EC5.tmp 2252 7F42.tmp 1440 7FCF.tmp 4624 804C.tmp 4396 80F7.tmp 1112 8184.tmp 3588 8230.tmp 2380 82AD.tmp 2352 832A.tmp 4612 83C6.tmp 2208 8434.tmp 928 84B1.tmp 2376 853D.tmp 1728 85BA.tmp 1500 8637.tmp 2512 86D3.tmp 3356 8770.tmp 3132 87ED.tmp 3096 885A.tmp 1164 88B8.tmp 3032 8935.tmp 3380 8993.tmp 4640 8A1F.tmp 2664 8A8D.tmp 2372 8AEA.tmp 1384 8B38.tmp 3348 8B87.tmp 2696 8BF4.tmp 4500 8C42.tmp 4384 8C90.tmp 904 8CDE.tmp 3496 8D3C.tmp 4900 8D8A.tmp 3304 8DF8.tmp 2976 8E46.tmp 1492 8EC3.tmp 100 8F11.tmp 1416 8F6F.tmp 3168 8FBD.tmp 4832 900B.tmp 4928 9059.tmp 628 90A7.tmp 1944 90F5.tmp 2156 9143.tmp 4200 9191.tmp 2660 91E0.tmp 220 922E.tmp 4944 928B.tmp 2252 92DA.tmp 3180 9337.tmp 1752 9395.tmp 1016 93E3.tmp 3768 9431.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE69.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 290F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 500F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 874C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3033.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9B46.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 974E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C60A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D33E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8836.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 81DD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E714.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F9B2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D590.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BA18.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D040.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7B3B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9961.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 92D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77DB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7838.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A3EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9867.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1519.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4CD3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 900B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E280.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 248A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B054.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 460D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 4900 5012 2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe 82 PID 5012 wrote to memory of 4900 5012 2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe 82 PID 5012 wrote to memory of 4900 5012 2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe 82 PID 4900 wrote to memory of 4296 4900 7908.tmp 83 PID 4900 wrote to memory of 4296 4900 7908.tmp 83 PID 4900 wrote to memory of 4296 4900 7908.tmp 83 PID 4296 wrote to memory of 4864 4296 79D3.tmp 84 PID 4296 wrote to memory of 4864 4296 79D3.tmp 84 PID 4296 wrote to memory of 4864 4296 79D3.tmp 84 PID 4864 wrote to memory of 1744 4864 7A50.tmp 85 PID 4864 wrote to memory of 1744 4864 7A50.tmp 85 PID 4864 wrote to memory of 1744 4864 7A50.tmp 85 PID 1744 wrote to memory of 2896 1744 7ABE.tmp 86 PID 1744 wrote to memory of 2896 1744 7ABE.tmp 86 PID 1744 wrote to memory of 2896 1744 7ABE.tmp 86 PID 2896 wrote to memory of 3336 2896 7B3B.tmp 87 PID 2896 wrote to memory of 3336 2896 7B3B.tmp 87 PID 2896 wrote to memory of 3336 2896 7B3B.tmp 87 PID 3336 wrote to memory of 1344 3336 7BC7.tmp 88 PID 3336 wrote to memory of 1344 3336 7BC7.tmp 88 PID 3336 wrote to memory of 1344 3336 7BC7.tmp 88 PID 1344 wrote to memory of 3688 1344 7C44.tmp 89 PID 1344 wrote to memory of 3688 1344 7C44.tmp 89 PID 1344 wrote to memory of 3688 1344 7C44.tmp 89 PID 3688 wrote to memory of 3692 3688 7C92.tmp 90 PID 3688 wrote to memory of 3692 3688 7C92.tmp 90 PID 3688 wrote to memory of 3692 3688 7C92.tmp 90 PID 3692 wrote to memory of 2920 3692 7D2F.tmp 91 PID 3692 wrote to memory of 2920 3692 7D2F.tmp 91 PID 3692 wrote to memory of 2920 3692 7D2F.tmp 91 PID 2920 wrote to memory of 220 2920 7DCB.tmp 92 PID 2920 wrote to memory of 220 2920 7DCB.tmp 92 PID 2920 wrote to memory of 220 2920 7DCB.tmp 92 PID 220 wrote to memory of 2192 220 7E58.tmp 93 PID 220 wrote to memory of 2192 220 7E58.tmp 93 PID 220 wrote to memory of 2192 220 7E58.tmp 93 PID 2192 wrote to memory of 2252 2192 7EC5.tmp 94 PID 2192 wrote to memory of 2252 2192 7EC5.tmp 94 PID 2192 wrote to memory of 2252 2192 7EC5.tmp 94 PID 2252 wrote to memory of 1440 2252 7F42.tmp 95 PID 2252 wrote to memory of 1440 2252 7F42.tmp 95 PID 2252 wrote to memory of 1440 2252 7F42.tmp 95 PID 1440 wrote to memory of 4624 1440 7FCF.tmp 96 PID 1440 wrote to memory of 4624 1440 7FCF.tmp 96 PID 1440 wrote to memory of 4624 1440 7FCF.tmp 96 PID 4624 wrote to memory of 4396 4624 804C.tmp 97 PID 4624 wrote to memory of 4396 4624 804C.tmp 97 PID 4624 wrote to memory of 4396 4624 804C.tmp 97 PID 4396 wrote to memory of 1112 4396 80F7.tmp 98 PID 4396 wrote to memory of 1112 4396 80F7.tmp 98 PID 4396 wrote to memory of 1112 4396 80F7.tmp 98 PID 1112 wrote to memory of 3588 1112 8184.tmp 99 PID 1112 wrote to memory of 3588 1112 8184.tmp 99 PID 1112 wrote to memory of 3588 1112 8184.tmp 99 PID 3588 wrote to memory of 2380 3588 8230.tmp 100 PID 3588 wrote to memory of 2380 3588 8230.tmp 100 PID 3588 wrote to memory of 2380 3588 8230.tmp 100 PID 2380 wrote to memory of 2352 2380 82AD.tmp 101 PID 2380 wrote to memory of 2352 2380 82AD.tmp 101 PID 2380 wrote to memory of 2352 2380 82AD.tmp 101 PID 2352 wrote to memory of 4612 2352 832A.tmp 102 PID 2352 wrote to memory of 4612 2352 832A.tmp 102 PID 2352 wrote to memory of 4612 2352 832A.tmp 102 PID 4612 wrote to memory of 2208 4612 83C6.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-28_10d8db4c56ff73b3878336838e9a77e4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\79D3.tmp"C:\Users\Admin\AppData\Local\Temp\79D3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"C:\Users\Admin\AppData\Local\Temp\7B3B.tmp"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\8230.tmp"C:\Users\Admin\AppData\Local\Temp\8230.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\83C6.tmp"C:\Users\Admin\AppData\Local\Temp\83C6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"23⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"24⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"25⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"26⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"27⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"28⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"29⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"30⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\885A.tmp"C:\Users\Admin\AppData\Local\Temp\885A.tmp"31⤵
- Executes dropped EXE
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\88B8.tmp"C:\Users\Admin\AppData\Local\Temp\88B8.tmp"32⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"33⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"34⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"35⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"36⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"37⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"38⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\8B87.tmp"C:\Users\Admin\AppData\Local\Temp\8B87.tmp"39⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"40⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"41⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"42⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"43⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"44⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"45⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"C:\Users\Admin\AppData\Local\Temp\8DF8.tmp"46⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"47⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"48⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"49⤵
- Executes dropped EXE
PID:100 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"50⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"51⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"52⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"53⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"54⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"55⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"56⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"57⤵
- Executes dropped EXE
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"58⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"59⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"60⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"61⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9337.tmp"C:\Users\Admin\AppData\Local\Temp\9337.tmp"62⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"63⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"64⤵
- Executes dropped EXE
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"65⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\947F.tmp"C:\Users\Admin\AppData\Local\Temp\947F.tmp"66⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"67⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"68⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"69⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"70⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"71⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\9664.tmp"C:\Users\Admin\AppData\Local\Temp\9664.tmp"72⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\96B2.tmp"C:\Users\Admin\AppData\Local\Temp\96B2.tmp"73⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"74⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"75⤵
- System Location Discovery: System Language Discovery
PID:8 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"76⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"77⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"78⤵
- System Location Discovery: System Language Discovery
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"79⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"80⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"81⤵
- System Location Discovery: System Language Discovery
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"82⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"83⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"C:\Users\Admin\AppData\Local\Temp\9A5B.tmp"84⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"85⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"86⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"87⤵
- System Location Discovery: System Language Discovery
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"88⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"89⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"90⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"91⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"92⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"93⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"94⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"C:\Users\Admin\AppData\Local\Temp\9DE6.tmp"95⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"96⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"97⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"98⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"99⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"100⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"101⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"102⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\A086.tmp"C:\Users\Admin\AppData\Local\Temp\A086.tmp"103⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"C:\Users\Admin\AppData\Local\Temp\A0D4.tmp"104⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\A122.tmp"C:\Users\Admin\AppData\Local\Temp\A122.tmp"105⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"106⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"107⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"108⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"109⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"110⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"111⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"112⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"113⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"114⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"115⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"116⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"117⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"119⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"120⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"121⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"122⤵PID:1752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-