Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20250314-en -
resource tags
arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system -
submitted
21/03/2025, 08:04
Static task
static1
Behavioral task
behavioral1
Sample
2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe
Resource
win7-20250207-en
Behavioral task
behavioral2
Sample
2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe
Resource
win10v2004-20250314-en
General
-
Target
2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe
-
Size
520KB
-
MD5
c1e796fed4687462c5c17a33f35d0ff8
-
SHA1
f27fe5fa44219547d6d6f87f7e96e636e8392d60
-
SHA256
acbc7dddebd393d0cbc53527b940cddc2fb5380ecf72a34afe6c90e31f6af640
-
SHA512
85561c4bf2e4790fa2d4269a771eee2083a31f5e47adf4650a826d2ed78e088af0dc84b100ed7fd17665c870484b934c378683710c76b6c5571629174ac9346a
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLf8C6Ba4dyR6H7SjV69cIxpjCGOCrbJWOqHisz:roRXOQjmOyvKa4e6HYqwGfJVqzNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4368 6BCA.tmp 5588 6C47.tmp 3984 6CA4.tmp 3276 6D02.tmp 5836 6D60.tmp 4688 6DBE.tmp 4300 6E1B.tmp 2480 6E69.tmp 6008 6EC7.tmp 2812 6F15.tmp 5724 6F63.tmp 2240 6FB2.tmp 4408 701F.tmp 4388 708C.tmp 4628 70FA.tmp 4768 7167.tmp 4752 71D4.tmp 4488 7223.tmp 3648 7271.tmp 4112 72BF.tmp 3944 732C.tmp 4904 738A.tmp 4736 73D8.tmp 5704 7436.tmp 2008 7484.tmp 4808 74D2.tmp 5792 7530.tmp 1980 759D.tmp 5564 75FB.tmp 2180 7649.tmp 4668 76C6.tmp 5216 7733.tmp 1724 77B0.tmp 2832 77FF.tmp 4612 784D.tmp 864 789B.tmp 5680 78E9.tmp 2344 7937.tmp 5292 7995.tmp 1364 79E3.tmp 5432 7A31.tmp 5284 7ABE.tmp 3644 7B0C.tmp 6032 7B5A.tmp 2016 7BB8.tmp 3568 7C15.tmp 1516 7C64.tmp 748 7CB2.tmp 1684 7D00.tmp 3112 7D4E.tmp 3596 7D9C.tmp 4208 7DEA.tmp 2604 7E38.tmp 208 7E86.tmp 5356 7ED5.tmp 5096 7F42.tmp 5308 7FA0.tmp 2816 7FFD.tmp 3164 805B.tmp 4880 80B9.tmp 5368 8107.tmp 1068 8155.tmp 5012 81A3.tmp 6104 81F1.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72BF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F1C2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 582D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66E3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7937.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9035.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ACF4.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F174.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 14BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 19FB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3AE1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 434D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7356.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B0F1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B8E0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D050.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8B05.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1085.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 150A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2C6A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3C1A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56A7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8EED.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABFA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 701F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB86.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3851.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 414A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B57.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 83E5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2507.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8661.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A066.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DA62.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6CEE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A5D0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F84A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 4368 2012 2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe 85 PID 2012 wrote to memory of 4368 2012 2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe 85 PID 2012 wrote to memory of 4368 2012 2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe 85 PID 4368 wrote to memory of 5588 4368 6BCA.tmp 87 PID 4368 wrote to memory of 5588 4368 6BCA.tmp 87 PID 4368 wrote to memory of 5588 4368 6BCA.tmp 87 PID 5588 wrote to memory of 3984 5588 6C47.tmp 88 PID 5588 wrote to memory of 3984 5588 6C47.tmp 88 PID 5588 wrote to memory of 3984 5588 6C47.tmp 88 PID 3984 wrote to memory of 3276 3984 6CA4.tmp 90 PID 3984 wrote to memory of 3276 3984 6CA4.tmp 90 PID 3984 wrote to memory of 3276 3984 6CA4.tmp 90 PID 3276 wrote to memory of 5836 3276 6D02.tmp 91 PID 3276 wrote to memory of 5836 3276 6D02.tmp 91 PID 3276 wrote to memory of 5836 3276 6D02.tmp 91 PID 5836 wrote to memory of 4688 5836 6D60.tmp 92 PID 5836 wrote to memory of 4688 5836 6D60.tmp 92 PID 5836 wrote to memory of 4688 5836 6D60.tmp 92 PID 4688 wrote to memory of 4300 4688 6DBE.tmp 93 PID 4688 wrote to memory of 4300 4688 6DBE.tmp 93 PID 4688 wrote to memory of 4300 4688 6DBE.tmp 93 PID 4300 wrote to memory of 2480 4300 6E1B.tmp 94 PID 4300 wrote to memory of 2480 4300 6E1B.tmp 94 PID 4300 wrote to memory of 2480 4300 6E1B.tmp 94 PID 2480 wrote to memory of 6008 2480 6E69.tmp 95 PID 2480 wrote to memory of 6008 2480 6E69.tmp 95 PID 2480 wrote to memory of 6008 2480 6E69.tmp 95 PID 6008 wrote to memory of 2812 6008 6EC7.tmp 96 PID 6008 wrote to memory of 2812 6008 6EC7.tmp 96 PID 6008 wrote to memory of 2812 6008 6EC7.tmp 96 PID 2812 wrote to memory of 5724 2812 6F15.tmp 97 PID 2812 wrote to memory of 5724 2812 6F15.tmp 97 PID 2812 wrote to memory of 5724 2812 6F15.tmp 97 PID 5724 wrote to memory of 2240 5724 6F63.tmp 98 PID 5724 wrote to memory of 2240 5724 6F63.tmp 98 PID 5724 wrote to memory of 2240 5724 6F63.tmp 98 PID 2240 wrote to memory of 4408 2240 6FB2.tmp 99 PID 2240 wrote to memory of 4408 2240 6FB2.tmp 99 PID 2240 wrote to memory of 4408 2240 6FB2.tmp 99 PID 4408 wrote to memory of 4388 4408 701F.tmp 100 PID 4408 wrote to memory of 4388 4408 701F.tmp 100 PID 4408 wrote to memory of 4388 4408 701F.tmp 100 PID 4388 wrote to memory of 4628 4388 708C.tmp 101 PID 4388 wrote to memory of 4628 4388 708C.tmp 101 PID 4388 wrote to memory of 4628 4388 708C.tmp 101 PID 4628 wrote to memory of 4768 4628 70FA.tmp 102 PID 4628 wrote to memory of 4768 4628 70FA.tmp 102 PID 4628 wrote to memory of 4768 4628 70FA.tmp 102 PID 4768 wrote to memory of 4752 4768 7167.tmp 103 PID 4768 wrote to memory of 4752 4768 7167.tmp 103 PID 4768 wrote to memory of 4752 4768 7167.tmp 103 PID 4752 wrote to memory of 4488 4752 71D4.tmp 104 PID 4752 wrote to memory of 4488 4752 71D4.tmp 104 PID 4752 wrote to memory of 4488 4752 71D4.tmp 104 PID 4488 wrote to memory of 3648 4488 7223.tmp 105 PID 4488 wrote to memory of 3648 4488 7223.tmp 105 PID 4488 wrote to memory of 3648 4488 7223.tmp 105 PID 3648 wrote to memory of 4112 3648 7271.tmp 106 PID 3648 wrote to memory of 4112 3648 7271.tmp 106 PID 3648 wrote to memory of 4112 3648 7271.tmp 106 PID 4112 wrote to memory of 3944 4112 72BF.tmp 107 PID 4112 wrote to memory of 3944 4112 72BF.tmp 107 PID 4112 wrote to memory of 3944 4112 72BF.tmp 107 PID 3944 wrote to memory of 4904 3944 732C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2025-03-21_c1e796fed4687462c5c17a33f35d0ff8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5836 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"23⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"24⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"25⤵
- Executes dropped EXE
PID:5704 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"26⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"27⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"28⤵
- Executes dropped EXE
PID:5792 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"29⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"30⤵
- Executes dropped EXE
PID:5564 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"31⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"32⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"33⤵
- Executes dropped EXE
PID:5216 -
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"34⤵
- Executes dropped EXE
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"35⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"36⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\789B.tmp"C:\Users\Admin\AppData\Local\Temp\789B.tmp"37⤵
- Executes dropped EXE
PID:864 -
C:\Users\Admin\AppData\Local\Temp\78E9.tmp"C:\Users\Admin\AppData\Local\Temp\78E9.tmp"38⤵
- Executes dropped EXE
PID:5680 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"39⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"40⤵
- Executes dropped EXE
PID:5292 -
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"41⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"42⤵
- Executes dropped EXE
PID:5432 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"43⤵
- Executes dropped EXE
PID:5284 -
C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"C:\Users\Admin\AppData\Local\Temp\7B0C.tmp"44⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"45⤵
- Executes dropped EXE
PID:6032 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"46⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"47⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"48⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"49⤵
- Executes dropped EXE
PID:748 -
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"50⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"51⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"52⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"53⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"54⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"55⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"56⤵
- Executes dropped EXE
PID:5356 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"57⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"58⤵
- Executes dropped EXE
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"59⤵
- Executes dropped EXE
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"60⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"61⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"62⤵
- Executes dropped EXE
PID:5368 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"63⤵
- Executes dropped EXE
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"64⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"65⤵
- Executes dropped EXE
PID:6104 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"66⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"67⤵PID:5728
-
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"68⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"69⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"70⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"71⤵
- System Location Discovery: System Language Discovery
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\8434.tmp"C:\Users\Admin\AppData\Local\Temp\8434.tmp"72⤵PID:6072
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"73⤵PID:5992
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"74⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"75⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"76⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"77⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\8637.tmp"C:\Users\Admin\AppData\Local\Temp\8637.tmp"78⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"79⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"80⤵PID:5164
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"81⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\877F.tmp"C:\Users\Admin\AppData\Local\Temp\877F.tmp"82⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"83⤵PID:5756
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"84⤵PID:5160
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"85⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"86⤵PID:6140
-
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"87⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"88⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\89B2.tmp"C:\Users\Admin\AppData\Local\Temp\89B2.tmp"89⤵PID:5696
-
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"90⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"91⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"C:\Users\Admin\AppData\Local\Temp\8A9C.tmp"92⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"93⤵PID:6012
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"94⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"95⤵PID:5916
-
C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"C:\Users\Admin\AppData\Local\Temp\8BE4.tmp"96⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"97⤵PID:5804
-
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"98⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"99⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"100⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"C:\Users\Admin\AppData\Local\Temp\8D7B.tmp"101⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"102⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"103⤵PID:5884
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"104⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"105⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"106⤵PID:5724
-
C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"C:\Users\Admin\AppData\Local\Temp\8F5F.tmp"107⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"108⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"109⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"110⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"111⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"112⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"113⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"114⤵PID:5476
-
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"115⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"116⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"117⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"118⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"119⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"120⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"121⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\9441.tmp"C:\Users\Admin\AppData\Local\Temp\9441.tmp"122⤵PID:3804
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-