Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe
-
Size
520KB
-
MD5
7a88d2a46f43078340bf6faa5f575020
-
SHA1
8e719bee917880de5a3ac583bd5f781745b798ef
-
SHA256
27d397a76841dbf660000da066fe662296741fb87fb0dc539cd78bb470884c28
-
SHA512
75ca19d321709d73a36e3a5e91754152c212ed67ebd2552e0be20d1dd4a08e337f3a4ac150e30aac8600542cda72f3a45c793f2f2c3a1ccfacd8c2544d174f5a
-
SSDEEP
12288:gj8fuxR21t5i8ftmNP8t1bGE7niCRhiJfaQ+mFNZ:gj8fuK1GYtmNmlF7nF4JYmFN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2648 606B.tmp 2124 60F7.tmp 2416 6155.tmp 1988 6210.tmp 3252 62AD.tmp 4856 6339.tmp 4576 63A7.tmp 2844 6404.tmp 4916 6481.tmp 4280 650E.tmp 2380 658B.tmp 3960 65F8.tmp 228 6685.tmp 3036 6721.tmp 3232 678F.tmp 2640 682B.tmp 1512 6898.tmp 2768 6925.tmp 1688 6983.tmp 4440 6A2F.tmp 3440 6A9C.tmp 704 6B29.tmp 1172 6BB5.tmp 4388 6C42.tmp 4744 6CAF.tmp 5040 6D4B.tmp 2140 6DA9.tmp 4668 6E17.tmp 4732 6E84.tmp 2948 6F20.tmp 3340 6F9D.tmp 3976 702A.tmp 748 7097.tmp 2296 7105.tmp 3692 7162.tmp 3852 71D0.tmp 3728 721E.tmp 2276 726C.tmp 4224 72CA.tmp 3436 7327.tmp 4836 7376.tmp 4800 73D3.tmp 4356 7431.tmp 3040 747F.tmp 2624 74CD.tmp 3296 752B.tmp 3680 7579.tmp 4628 75C7.tmp 1292 7615.tmp 3136 7673.tmp 1484 76D1.tmp 5024 773E.tmp 60 778C.tmp 4576 77EA.tmp 2520 7838.tmp 1176 7886.tmp 4916 78D5.tmp 1720 7942.tmp 4552 79A0.tmp 3960 79EE.tmp 3980 7A3C.tmp 4608 7A9A.tmp 3180 7AE8.tmp 1400 7B36.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8BEF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A90C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F48C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F538.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6121.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB1D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C445.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B2FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6E2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6D4B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6901.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A4C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8C4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C0F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6F20.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7FBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C32C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD2C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E809.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F170.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3DE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 96CC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CCA2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DBB5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1795.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DF5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C029.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C73.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C70.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E951.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7942.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4EA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB91.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6E7F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 77F5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2648 2912 2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe 89 PID 2912 wrote to memory of 2648 2912 2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe 89 PID 2912 wrote to memory of 2648 2912 2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe 89 PID 2648 wrote to memory of 2124 2648 606B.tmp 90 PID 2648 wrote to memory of 2124 2648 606B.tmp 90 PID 2648 wrote to memory of 2124 2648 606B.tmp 90 PID 2124 wrote to memory of 2416 2124 60F7.tmp 91 PID 2124 wrote to memory of 2416 2124 60F7.tmp 91 PID 2124 wrote to memory of 2416 2124 60F7.tmp 91 PID 2416 wrote to memory of 1988 2416 6155.tmp 92 PID 2416 wrote to memory of 1988 2416 6155.tmp 92 PID 2416 wrote to memory of 1988 2416 6155.tmp 92 PID 1988 wrote to memory of 3252 1988 6210.tmp 93 PID 1988 wrote to memory of 3252 1988 6210.tmp 93 PID 1988 wrote to memory of 3252 1988 6210.tmp 93 PID 3252 wrote to memory of 4856 3252 62AD.tmp 94 PID 3252 wrote to memory of 4856 3252 62AD.tmp 94 PID 3252 wrote to memory of 4856 3252 62AD.tmp 94 PID 4856 wrote to memory of 4576 4856 6339.tmp 95 PID 4856 wrote to memory of 4576 4856 6339.tmp 95 PID 4856 wrote to memory of 4576 4856 6339.tmp 95 PID 4576 wrote to memory of 2844 4576 63A7.tmp 96 PID 4576 wrote to memory of 2844 4576 63A7.tmp 96 PID 4576 wrote to memory of 2844 4576 63A7.tmp 96 PID 2844 wrote to memory of 4916 2844 6404.tmp 97 PID 2844 wrote to memory of 4916 2844 6404.tmp 97 PID 2844 wrote to memory of 4916 2844 6404.tmp 97 PID 4916 wrote to memory of 4280 4916 6481.tmp 98 PID 4916 wrote to memory of 4280 4916 6481.tmp 98 PID 4916 wrote to memory of 4280 4916 6481.tmp 98 PID 4280 wrote to memory of 2380 4280 650E.tmp 99 PID 4280 wrote to memory of 2380 4280 650E.tmp 99 PID 4280 wrote to memory of 2380 4280 650E.tmp 99 PID 2380 wrote to memory of 3960 2380 658B.tmp 100 PID 2380 wrote to memory of 3960 2380 658B.tmp 100 PID 2380 wrote to memory of 3960 2380 658B.tmp 100 PID 3960 wrote to memory of 228 3960 65F8.tmp 101 PID 3960 wrote to memory of 228 3960 65F8.tmp 101 PID 3960 wrote to memory of 228 3960 65F8.tmp 101 PID 228 wrote to memory of 3036 228 6685.tmp 102 PID 228 wrote to memory of 3036 228 6685.tmp 102 PID 228 wrote to memory of 3036 228 6685.tmp 102 PID 3036 wrote to memory of 3232 3036 6721.tmp 103 PID 3036 wrote to memory of 3232 3036 6721.tmp 103 PID 3036 wrote to memory of 3232 3036 6721.tmp 103 PID 3232 wrote to memory of 2640 3232 678F.tmp 104 PID 3232 wrote to memory of 2640 3232 678F.tmp 104 PID 3232 wrote to memory of 2640 3232 678F.tmp 104 PID 2640 wrote to memory of 1512 2640 682B.tmp 105 PID 2640 wrote to memory of 1512 2640 682B.tmp 105 PID 2640 wrote to memory of 1512 2640 682B.tmp 105 PID 1512 wrote to memory of 2768 1512 6898.tmp 106 PID 1512 wrote to memory of 2768 1512 6898.tmp 106 PID 1512 wrote to memory of 2768 1512 6898.tmp 106 PID 2768 wrote to memory of 1688 2768 6925.tmp 107 PID 2768 wrote to memory of 1688 2768 6925.tmp 107 PID 2768 wrote to memory of 1688 2768 6925.tmp 107 PID 1688 wrote to memory of 4440 1688 6983.tmp 108 PID 1688 wrote to memory of 4440 1688 6983.tmp 108 PID 1688 wrote to memory of 4440 1688 6983.tmp 108 PID 4440 wrote to memory of 3440 4440 6A2F.tmp 109 PID 4440 wrote to memory of 3440 4440 6A2F.tmp 109 PID 4440 wrote to memory of 3440 4440 6A2F.tmp 109 PID 3440 wrote to memory of 704 3440 6A9C.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-09-29_7a88d2a46f43078340bf6faa5f575020_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\606B.tmp"C:\Users\Admin\AppData\Local\Temp\606B.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\60F7.tmp"C:\Users\Admin\AppData\Local\Temp\60F7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\6155.tmp"C:\Users\Admin\AppData\Local\Temp\6155.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\6210.tmp"C:\Users\Admin\AppData\Local\Temp\6210.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\62AD.tmp"C:\Users\Admin\AppData\Local\Temp\62AD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\6339.tmp"C:\Users\Admin\AppData\Local\Temp\6339.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\63A7.tmp"C:\Users\Admin\AppData\Local\Temp\63A7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\6404.tmp"C:\Users\Admin\AppData\Local\Temp\6404.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\6481.tmp"C:\Users\Admin\AppData\Local\Temp\6481.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\650E.tmp"C:\Users\Admin\AppData\Local\Temp\650E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\658B.tmp"C:\Users\Admin\AppData\Local\Temp\658B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\65F8.tmp"C:\Users\Admin\AppData\Local\Temp\65F8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\6685.tmp"C:\Users\Admin\AppData\Local\Temp\6685.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
C:\Users\Admin\AppData\Local\Temp\6721.tmp"C:\Users\Admin\AppData\Local\Temp\6721.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\678F.tmp"C:\Users\Admin\AppData\Local\Temp\678F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\682B.tmp"C:\Users\Admin\AppData\Local\Temp\682B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\6898.tmp"C:\Users\Admin\AppData\Local\Temp\6898.tmp"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6925.tmp"C:\Users\Admin\AppData\Local\Temp\6925.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\6983.tmp"C:\Users\Admin\AppData\Local\Temp\6983.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"C:\Users\Admin\AppData\Local\Temp\6A2F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"C:\Users\Admin\AppData\Local\Temp\6A9C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\6B29.tmp"C:\Users\Admin\AppData\Local\Temp\6B29.tmp"23⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"C:\Users\Admin\AppData\Local\Temp\6BB5.tmp"24⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\6C42.tmp"C:\Users\Admin\AppData\Local\Temp\6C42.tmp"25⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"C:\Users\Admin\AppData\Local\Temp\6CAF.tmp"26⤵
- Executes dropped EXE
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"C:\Users\Admin\AppData\Local\Temp\6D4B.tmp"27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"C:\Users\Admin\AppData\Local\Temp\6DA9.tmp"28⤵
- Executes dropped EXE
PID:2140 -
C:\Users\Admin\AppData\Local\Temp\6E17.tmp"C:\Users\Admin\AppData\Local\Temp\6E17.tmp"29⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6E84.tmp"C:\Users\Admin\AppData\Local\Temp\6E84.tmp"30⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\6F20.tmp"C:\Users\Admin\AppData\Local\Temp\6F20.tmp"31⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"32⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\702A.tmp"C:\Users\Admin\AppData\Local\Temp\702A.tmp"33⤵
- Executes dropped EXE
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\7097.tmp"C:\Users\Admin\AppData\Local\Temp\7097.tmp"34⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\7105.tmp"C:\Users\Admin\AppData\Local\Temp\7105.tmp"35⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\7162.tmp"C:\Users\Admin\AppData\Local\Temp\7162.tmp"36⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\71D0.tmp"C:\Users\Admin\AppData\Local\Temp\71D0.tmp"37⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\721E.tmp"C:\Users\Admin\AppData\Local\Temp\721E.tmp"38⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\726C.tmp"C:\Users\Admin\AppData\Local\Temp\726C.tmp"39⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\72CA.tmp"C:\Users\Admin\AppData\Local\Temp\72CA.tmp"40⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\7327.tmp"C:\Users\Admin\AppData\Local\Temp\7327.tmp"41⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\7376.tmp"C:\Users\Admin\AppData\Local\Temp\7376.tmp"42⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\73D3.tmp"C:\Users\Admin\AppData\Local\Temp\73D3.tmp"43⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\7431.tmp"C:\Users\Admin\AppData\Local\Temp\7431.tmp"44⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\747F.tmp"C:\Users\Admin\AppData\Local\Temp\747F.tmp"45⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\74CD.tmp"C:\Users\Admin\AppData\Local\Temp\74CD.tmp"46⤵
- Executes dropped EXE
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\752B.tmp"C:\Users\Admin\AppData\Local\Temp\752B.tmp"47⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7579.tmp"C:\Users\Admin\AppData\Local\Temp\7579.tmp"48⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\75C7.tmp"C:\Users\Admin\AppData\Local\Temp\75C7.tmp"49⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7615.tmp"C:\Users\Admin\AppData\Local\Temp\7615.tmp"50⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7673.tmp"C:\Users\Admin\AppData\Local\Temp\7673.tmp"51⤵
- Executes dropped EXE
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\76D1.tmp"C:\Users\Admin\AppData\Local\Temp\76D1.tmp"52⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\773E.tmp"C:\Users\Admin\AppData\Local\Temp\773E.tmp"53⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\778C.tmp"C:\Users\Admin\AppData\Local\Temp\778C.tmp"54⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\77EA.tmp"C:\Users\Admin\AppData\Local\Temp\77EA.tmp"55⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\7838.tmp"C:\Users\Admin\AppData\Local\Temp\7838.tmp"56⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\7886.tmp"C:\Users\Admin\AppData\Local\Temp\7886.tmp"57⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\78D5.tmp"C:\Users\Admin\AppData\Local\Temp\78D5.tmp"58⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\7942.tmp"C:\Users\Admin\AppData\Local\Temp\7942.tmp"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\79A0.tmp"C:\Users\Admin\AppData\Local\Temp\79A0.tmp"60⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\79EE.tmp"C:\Users\Admin\AppData\Local\Temp\79EE.tmp"61⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"C:\Users\Admin\AppData\Local\Temp\7A3C.tmp"62⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"C:\Users\Admin\AppData\Local\Temp\7A9A.tmp"63⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"C:\Users\Admin\AppData\Local\Temp\7AE8.tmp"64⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\7B36.tmp"C:\Users\Admin\AppData\Local\Temp\7B36.tmp"65⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7B94.tmp"C:\Users\Admin\AppData\Local\Temp\7B94.tmp"66⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7C01.tmp"C:\Users\Admin\AppData\Local\Temp\7C01.tmp"67⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"68⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"C:\Users\Admin\AppData\Local\Temp\7CDC.tmp"69⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"C:\Users\Admin\AppData\Local\Temp\7D3A.tmp"70⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\7D97.tmp"C:\Users\Admin\AppData\Local\Temp\7D97.tmp"71⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"C:\Users\Admin\AppData\Local\Temp\7DE5.tmp"72⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\7E53.tmp"C:\Users\Admin\AppData\Local\Temp\7E53.tmp"73⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"C:\Users\Admin\AppData\Local\Temp\7EA1.tmp"74⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"C:\Users\Admin\AppData\Local\Temp\7F0E.tmp"75⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"C:\Users\Admin\AppData\Local\Temp\7F5C.tmp"76⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"C:\Users\Admin\AppData\Local\Temp\7FBA.tmp"77⤵
- System Location Discovery: System Language Discovery
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8018.tmp"C:\Users\Admin\AppData\Local\Temp\8018.tmp"78⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\8076.tmp"C:\Users\Admin\AppData\Local\Temp\8076.tmp"79⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\80D3.tmp"C:\Users\Admin\AppData\Local\Temp\80D3.tmp"80⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\8141.tmp"C:\Users\Admin\AppData\Local\Temp\8141.tmp"81⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\819F.tmp"C:\Users\Admin\AppData\Local\Temp\819F.tmp"82⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\820C.tmp"C:\Users\Admin\AppData\Local\Temp\820C.tmp"83⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\825A.tmp"C:\Users\Admin\AppData\Local\Temp\825A.tmp"84⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\82A8.tmp"C:\Users\Admin\AppData\Local\Temp\82A8.tmp"85⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8306.tmp"C:\Users\Admin\AppData\Local\Temp\8306.tmp"86⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\8373.tmp"C:\Users\Admin\AppData\Local\Temp\8373.tmp"87⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\83D1.tmp"C:\Users\Admin\AppData\Local\Temp\83D1.tmp"88⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\842F.tmp"C:\Users\Admin\AppData\Local\Temp\842F.tmp"89⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\848D.tmp"C:\Users\Admin\AppData\Local\Temp\848D.tmp"90⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\84EA.tmp"C:\Users\Admin\AppData\Local\Temp\84EA.tmp"91⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\8548.tmp"C:\Users\Admin\AppData\Local\Temp\8548.tmp"92⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\85A6.tmp"C:\Users\Admin\AppData\Local\Temp\85A6.tmp"93⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\8604.tmp"C:\Users\Admin\AppData\Local\Temp\8604.tmp"94⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\8661.tmp"C:\Users\Admin\AppData\Local\Temp\8661.tmp"95⤵
- System Location Discovery: System Language Discovery
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\86CF.tmp"C:\Users\Admin\AppData\Local\Temp\86CF.tmp"96⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\872C.tmp"C:\Users\Admin\AppData\Local\Temp\872C.tmp"97⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\877B.tmp"C:\Users\Admin\AppData\Local\Temp\877B.tmp"98⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\87D8.tmp"C:\Users\Admin\AppData\Local\Temp\87D8.tmp"99⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\8836.tmp"C:\Users\Admin\AppData\Local\Temp\8836.tmp"100⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\8884.tmp"C:\Users\Admin\AppData\Local\Temp\8884.tmp"101⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\88E2.tmp"C:\Users\Admin\AppData\Local\Temp\88E2.tmp"102⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\8940.tmp"C:\Users\Admin\AppData\Local\Temp\8940.tmp"103⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\899D.tmp"C:\Users\Admin\AppData\Local\Temp\899D.tmp"104⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\89FB.tmp"C:\Users\Admin\AppData\Local\Temp\89FB.tmp"105⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\8A59.tmp"C:\Users\Admin\AppData\Local\Temp\8A59.tmp"106⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"C:\Users\Admin\AppData\Local\Temp\8AA7.tmp"107⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"C:\Users\Admin\AppData\Local\Temp\8AF5.tmp"108⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\8B43.tmp"C:\Users\Admin\AppData\Local\Temp\8B43.tmp"109⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"C:\Users\Admin\AppData\Local\Temp\8BA1.tmp"110⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"111⤵
- System Location Discovery: System Language Discovery
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"C:\Users\Admin\AppData\Local\Temp\8C4D.tmp"112⤵
- System Location Discovery: System Language Discovery
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"C:\Users\Admin\AppData\Local\Temp\8C9B.tmp"113⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"C:\Users\Admin\AppData\Local\Temp\8CF9.tmp"114⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\8D57.tmp"C:\Users\Admin\AppData\Local\Temp\8D57.tmp"115⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"C:\Users\Admin\AppData\Local\Temp\8DB4.tmp"116⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"117⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\8E51.tmp"C:\Users\Admin\AppData\Local\Temp\8E51.tmp"118⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"C:\Users\Admin\AppData\Local\Temp\8EAE.tmp"119⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"C:\Users\Admin\AppData\Local\Temp\8EFC.tmp"120⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"C:\Users\Admin\AppData\Local\Temp\8F5A.tmp"121⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"122⤵PID:2308
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-