Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
01/10/2024, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe
-
Size
530KB
-
MD5
1274a4e32794d4a1cf43c08203df8474
-
SHA1
de78254acd62eb9ce81802855472c7a036a80ccc
-
SHA256
a69e3c1a3632d5c1a160712d264b3549d6c196e6007c45377fb727ccc7af3771
-
SHA512
36f9fcae484962c1528bc2095491b5a56a67bdd7df66bb8240babe3869eccbd881bb4fb2486472de20cd8ea7ce3b7f5866549da7a445d0ea4166962c804ffe44
-
SSDEEP
12288:AU5rCOTeio4JKPhVr2HACuZs2fU+/kXhtvNZulFVg0M1:AUQOJoEKpYdkeHvNclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1272 7F32.tmp 4852 7FBF.tmp 3000 801D.tmp 4564 808A.tmp 3496 8107.tmp 4108 8165.tmp 1712 81D2.tmp 1072 8240.tmp 4720 829D.tmp 1624 82FB.tmp 2224 8359.tmp 4448 83B7.tmp 4816 8405.tmp 880 8472.tmp 2956 84DF.tmp 3172 852E.tmp 1812 859B.tmp 4488 8618.tmp 1344 8695.tmp 5080 86E3.tmp 812 8731.tmp 2304 878F.tmp 4836 87ED.tmp 1956 8879.tmp 972 88E7.tmp 1416 8954.tmp 904 89A2.tmp 3768 8A1F.tmp 552 8A7D.tmp 3468 8AFA.tmp 3288 8B77.tmp 4924 8BE4.tmp 60 8C52.tmp 4876 8CAF.tmp 2976 8D0D.tmp 4552 8D6B.tmp 3940 8DB9.tmp 4036 8E17.tmp 3296 8E75.tmp 3664 8EC3.tmp 2104 8F20.tmp 4968 8F7E.tmp 512 8FDC.tmp 2068 902A.tmp 4392 9088.tmp 3492 90E6.tmp 3328 9143.tmp 2192 91A1.tmp 1144 920E.tmp 1840 925D.tmp 1664 92BA.tmp 1392 9308.tmp 860 9357.tmp 2780 93B4.tmp 4072 9412.tmp 2892 9460.tmp 1548 94AE.tmp 4992 950C.tmp 3104 955A.tmp 1120 95A8.tmp 1672 95F6.tmp 4560 9645.tmp 4456 9693.tmp 1508 96E1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EB1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B1EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AA74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 778C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9229.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CC44.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EACD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 67EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9088.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D7A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4BBA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3709.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 773E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B083.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B391.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FA9C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 728B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E772.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 553F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 17D8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40EC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B9D5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9C5F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BDE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DC85.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E14.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 12F6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 178A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C743.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C023.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1D57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6BA6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BD8E.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B594.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5D7D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 1272 968 2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe 82 PID 968 wrote to memory of 1272 968 2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe 82 PID 968 wrote to memory of 1272 968 2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe 82 PID 1272 wrote to memory of 4852 1272 7F32.tmp 83 PID 1272 wrote to memory of 4852 1272 7F32.tmp 83 PID 1272 wrote to memory of 4852 1272 7F32.tmp 83 PID 4852 wrote to memory of 3000 4852 7FBF.tmp 84 PID 4852 wrote to memory of 3000 4852 7FBF.tmp 84 PID 4852 wrote to memory of 3000 4852 7FBF.tmp 84 PID 3000 wrote to memory of 4564 3000 801D.tmp 85 PID 3000 wrote to memory of 4564 3000 801D.tmp 85 PID 3000 wrote to memory of 4564 3000 801D.tmp 85 PID 4564 wrote to memory of 3496 4564 808A.tmp 86 PID 4564 wrote to memory of 3496 4564 808A.tmp 86 PID 4564 wrote to memory of 3496 4564 808A.tmp 86 PID 3496 wrote to memory of 4108 3496 8107.tmp 87 PID 3496 wrote to memory of 4108 3496 8107.tmp 87 PID 3496 wrote to memory of 4108 3496 8107.tmp 87 PID 4108 wrote to memory of 1712 4108 8165.tmp 88 PID 4108 wrote to memory of 1712 4108 8165.tmp 88 PID 4108 wrote to memory of 1712 4108 8165.tmp 88 PID 1712 wrote to memory of 1072 1712 81D2.tmp 89 PID 1712 wrote to memory of 1072 1712 81D2.tmp 89 PID 1712 wrote to memory of 1072 1712 81D2.tmp 89 PID 1072 wrote to memory of 4720 1072 8240.tmp 90 PID 1072 wrote to memory of 4720 1072 8240.tmp 90 PID 1072 wrote to memory of 4720 1072 8240.tmp 90 PID 4720 wrote to memory of 1624 4720 829D.tmp 91 PID 4720 wrote to memory of 1624 4720 829D.tmp 91 PID 4720 wrote to memory of 1624 4720 829D.tmp 91 PID 1624 wrote to memory of 2224 1624 82FB.tmp 92 PID 1624 wrote to memory of 2224 1624 82FB.tmp 92 PID 1624 wrote to memory of 2224 1624 82FB.tmp 92 PID 2224 wrote to memory of 4448 2224 8359.tmp 93 PID 2224 wrote to memory of 4448 2224 8359.tmp 93 PID 2224 wrote to memory of 4448 2224 8359.tmp 93 PID 4448 wrote to memory of 4816 4448 83B7.tmp 94 PID 4448 wrote to memory of 4816 4448 83B7.tmp 94 PID 4448 wrote to memory of 4816 4448 83B7.tmp 94 PID 4816 wrote to memory of 880 4816 8405.tmp 95 PID 4816 wrote to memory of 880 4816 8405.tmp 95 PID 4816 wrote to memory of 880 4816 8405.tmp 95 PID 880 wrote to memory of 2956 880 8472.tmp 96 PID 880 wrote to memory of 2956 880 8472.tmp 96 PID 880 wrote to memory of 2956 880 8472.tmp 96 PID 2956 wrote to memory of 3172 2956 84DF.tmp 97 PID 2956 wrote to memory of 3172 2956 84DF.tmp 97 PID 2956 wrote to memory of 3172 2956 84DF.tmp 97 PID 3172 wrote to memory of 1812 3172 852E.tmp 98 PID 3172 wrote to memory of 1812 3172 852E.tmp 98 PID 3172 wrote to memory of 1812 3172 852E.tmp 98 PID 1812 wrote to memory of 4488 1812 859B.tmp 99 PID 1812 wrote to memory of 4488 1812 859B.tmp 99 PID 1812 wrote to memory of 4488 1812 859B.tmp 99 PID 4488 wrote to memory of 1344 4488 8618.tmp 100 PID 4488 wrote to memory of 1344 4488 8618.tmp 100 PID 4488 wrote to memory of 1344 4488 8618.tmp 100 PID 1344 wrote to memory of 5080 1344 8695.tmp 101 PID 1344 wrote to memory of 5080 1344 8695.tmp 101 PID 1344 wrote to memory of 5080 1344 8695.tmp 101 PID 5080 wrote to memory of 812 5080 86E3.tmp 102 PID 5080 wrote to memory of 812 5080 86E3.tmp 102 PID 5080 wrote to memory of 812 5080 86E3.tmp 102 PID 812 wrote to memory of 2304 812 8731.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-01_1274a4e32794d4a1cf43c08203df8474_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\7F32.tmp"C:\Users\Admin\AppData\Local\Temp\7F32.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"C:\Users\Admin\AppData\Local\Temp\7FBF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\801D.tmp"C:\Users\Admin\AppData\Local\Temp\801D.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\8405.tmp"C:\Users\Admin\AppData\Local\Temp\8405.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\8695.tmp"C:\Users\Admin\AppData\Local\Temp\8695.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"23⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"24⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"25⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\88E7.tmp"C:\Users\Admin\AppData\Local\Temp\88E7.tmp"26⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\8954.tmp"C:\Users\Admin\AppData\Local\Temp\8954.tmp"27⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\89A2.tmp"C:\Users\Admin\AppData\Local\Temp\89A2.tmp"28⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"29⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"30⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"31⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\8B77.tmp"C:\Users\Admin\AppData\Local\Temp\8B77.tmp"32⤵
- Executes dropped EXE
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"33⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"34⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"35⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"36⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"37⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"38⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"39⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"40⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"41⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"42⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"C:\Users\Admin\AppData\Local\Temp\8F7E.tmp"43⤵
- Executes dropped EXE
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"44⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\902A.tmp"C:\Users\Admin\AppData\Local\Temp\902A.tmp"45⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\9088.tmp"C:\Users\Admin\AppData\Local\Temp\9088.tmp"46⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"47⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\9143.tmp"C:\Users\Admin\AppData\Local\Temp\9143.tmp"48⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"49⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"50⤵
- Executes dropped EXE
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"51⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"52⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"53⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"54⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\93B4.tmp"C:\Users\Admin\AppData\Local\Temp\93B4.tmp"55⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"56⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"57⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"58⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\950C.tmp"C:\Users\Admin\AppData\Local\Temp\950C.tmp"59⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"60⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\95A8.tmp"C:\Users\Admin\AppData\Local\Temp\95A8.tmp"61⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"62⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"63⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"64⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"65⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"66⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"67⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"68⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\9819.tmp"C:\Users\Admin\AppData\Local\Temp\9819.tmp"69⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\9867.tmp"C:\Users\Admin\AppData\Local\Temp\9867.tmp"70⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"71⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"72⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"73⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"74⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"75⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"76⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"78⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"79⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"80⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"81⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"82⤵
- System Location Discovery: System Language Discovery
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"83⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"84⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\9D49.tmp"C:\Users\Admin\AppData\Local\Temp\9D49.tmp"85⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"86⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"87⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"88⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"89⤵
- System Location Discovery: System Language Discovery
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"90⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"C:\Users\Admin\AppData\Local\Temp\9F5D.tmp"91⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"92⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"93⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"94⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"C:\Users\Admin\AppData\Local\Temp\A0C4.tmp"95⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"96⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"97⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"C:\Users\Admin\AppData\Local\Temp\A1AE.tmp"98⤵PID:716
-
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"99⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"100⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"101⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"102⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\A374.tmp"C:\Users\Admin\AppData\Local\Temp\A374.tmp"103⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"104⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\A42F.tmp"C:\Users\Admin\AppData\Local\Temp\A42F.tmp"105⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"106⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"107⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"108⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"109⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"110⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"111⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"112⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"113⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"114⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\A79A.tmp"C:\Users\Admin\AppData\Local\Temp\A79A.tmp"115⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"116⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"117⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"118⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"119⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"120⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\A98E.tmp"C:\Users\Admin\AppData\Local\Temp\A98E.tmp"121⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"122⤵PID:1144
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-