Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240730-en -
resource tags
arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system -
submitted
02/08/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
Resource
win10v2004-20240730-en
General
-
Target
2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe
-
Size
712KB
-
MD5
d393478ec9d6b709ee7a0a8c81772b80
-
SHA1
1b4070d0f41f1d24c350c8d4be7b390f47dceb43
-
SHA256
e5b5a514fe6ee7055a2996e1da0c52fb0acd7d51efe54818d6a35f632c26d796
-
SHA512
e3d71b6a14c63d7a94e40db5dbdde7a3fe77b35e14426ebdedfff7676d62d25602879758fb583122dba1275508769d7888b6a222811f53e6b60460d1d0a97f05
-
SSDEEP
12288:FU5rCOTeiDCLmjEVx0J6qnMWNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:FUQOJDw8EE6qBNnCvq5TJLCvY90D8/L5
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 972 BD93.tmp 692 BE20.tmp 4604 BEFA.tmp 2492 BFB6.tmp 3228 C071.tmp 1492 C10E.tmp 2908 C18B.tmp 3104 C1E8.tmp 232 C275.tmp 3492 C302.tmp 1348 C3BD.tmp 920 C479.tmp 4712 C525.tmp 3312 C5C1.tmp 2244 C65D.tmp 4912 C709.tmp 3424 C7A5.tmp 2892 C851.tmp 3900 C8FD.tmp 4520 C98A.tmp 4280 CA26.tmp 2640 CAE1.tmp 4596 CB7E.tmp 540 CC29.tmp 1692 CCC6.tmp 1608 CD43.tmp 3992 CDFE.tmp 2208 CE9A.tmp 216 CF37.tmp 1728 CFC3.tmp 324 D060.tmp 452 D10B.tmp 1964 D1B7.tmp 4312 D225.tmp 2420 D282.tmp 4728 D2E0.tmp 4996 D32E.tmp 2112 D38C.tmp 428 D3EA.tmp 4860 D457.tmp 3256 D4C5.tmp 4868 D532.tmp 2540 D5AF.tmp 4468 D5FD.tmp 1400 D66A.tmp 3192 D6B9.tmp 4220 D716.tmp 4032 D793.tmp 4472 D7E1.tmp 4452 D84F.tmp 4284 D8AD.tmp 2076 D8FB.tmp 4976 D968.tmp 2036 D9D5.tmp 2412 DA33.tmp 880 DA91.tmp 3428 DAFE.tmp 1140 DB4C.tmp 4972 DBAA.tmp 816 DBF8.tmp 1284 DC46.tmp 2156 DCB4.tmp 1492 DD02.tmp 3212 DD6F.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 304D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 32C3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2E0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 79AF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 23EE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9073.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BEA8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C479.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4C56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6B29.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1F56.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2929.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7673.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FFD7.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1553.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2810.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 583D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D462.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BFD0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DD02.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5F13.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5EC5.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FB48.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 190C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 30B0.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9630.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C525.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 91BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C6B6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C82D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E493.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9CF.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D2BC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EC83.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74FC.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language A67C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2D16.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4179.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CB0B.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 972 4976 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 84 PID 4976 wrote to memory of 972 4976 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 84 PID 4976 wrote to memory of 972 4976 2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe 84 PID 972 wrote to memory of 692 972 BD93.tmp 86 PID 972 wrote to memory of 692 972 BD93.tmp 86 PID 972 wrote to memory of 692 972 BD93.tmp 86 PID 692 wrote to memory of 4604 692 BE20.tmp 87 PID 692 wrote to memory of 4604 692 BE20.tmp 87 PID 692 wrote to memory of 4604 692 BE20.tmp 87 PID 4604 wrote to memory of 2492 4604 BEFA.tmp 89 PID 4604 wrote to memory of 2492 4604 BEFA.tmp 89 PID 4604 wrote to memory of 2492 4604 BEFA.tmp 89 PID 2492 wrote to memory of 3228 2492 BFB6.tmp 90 PID 2492 wrote to memory of 3228 2492 BFB6.tmp 90 PID 2492 wrote to memory of 3228 2492 BFB6.tmp 90 PID 3228 wrote to memory of 1492 3228 C071.tmp 91 PID 3228 wrote to memory of 1492 3228 C071.tmp 91 PID 3228 wrote to memory of 1492 3228 C071.tmp 91 PID 1492 wrote to memory of 2908 1492 C10E.tmp 92 PID 1492 wrote to memory of 2908 1492 C10E.tmp 92 PID 1492 wrote to memory of 2908 1492 C10E.tmp 92 PID 2908 wrote to memory of 3104 2908 C18B.tmp 93 PID 2908 wrote to memory of 3104 2908 C18B.tmp 93 PID 2908 wrote to memory of 3104 2908 C18B.tmp 93 PID 3104 wrote to memory of 232 3104 C1E8.tmp 94 PID 3104 wrote to memory of 232 3104 C1E8.tmp 94 PID 3104 wrote to memory of 232 3104 C1E8.tmp 94 PID 232 wrote to memory of 3492 232 C275.tmp 95 PID 232 wrote to memory of 3492 232 C275.tmp 95 PID 232 wrote to memory of 3492 232 C275.tmp 95 PID 3492 wrote to memory of 1348 3492 C302.tmp 96 PID 3492 wrote to memory of 1348 3492 C302.tmp 96 PID 3492 wrote to memory of 1348 3492 C302.tmp 96 PID 1348 wrote to memory of 920 1348 C3BD.tmp 97 PID 1348 wrote to memory of 920 1348 C3BD.tmp 97 PID 1348 wrote to memory of 920 1348 C3BD.tmp 97 PID 920 wrote to memory of 4712 920 C479.tmp 98 PID 920 wrote to memory of 4712 920 C479.tmp 98 PID 920 wrote to memory of 4712 920 C479.tmp 98 PID 4712 wrote to memory of 3312 4712 C525.tmp 99 PID 4712 wrote to memory of 3312 4712 C525.tmp 99 PID 4712 wrote to memory of 3312 4712 C525.tmp 99 PID 3312 wrote to memory of 2244 3312 C5C1.tmp 100 PID 3312 wrote to memory of 2244 3312 C5C1.tmp 100 PID 3312 wrote to memory of 2244 3312 C5C1.tmp 100 PID 2244 wrote to memory of 4912 2244 C65D.tmp 101 PID 2244 wrote to memory of 4912 2244 C65D.tmp 101 PID 2244 wrote to memory of 4912 2244 C65D.tmp 101 PID 4912 wrote to memory of 3424 4912 C709.tmp 102 PID 4912 wrote to memory of 3424 4912 C709.tmp 102 PID 4912 wrote to memory of 3424 4912 C709.tmp 102 PID 3424 wrote to memory of 2892 3424 C7A5.tmp 103 PID 3424 wrote to memory of 2892 3424 C7A5.tmp 103 PID 3424 wrote to memory of 2892 3424 C7A5.tmp 103 PID 2892 wrote to memory of 3900 2892 C851.tmp 104 PID 2892 wrote to memory of 3900 2892 C851.tmp 104 PID 2892 wrote to memory of 3900 2892 C851.tmp 104 PID 3900 wrote to memory of 4520 3900 C8FD.tmp 105 PID 3900 wrote to memory of 4520 3900 C8FD.tmp 105 PID 3900 wrote to memory of 4520 3900 C8FD.tmp 105 PID 4520 wrote to memory of 4280 4520 C98A.tmp 106 PID 4520 wrote to memory of 4280 4520 C98A.tmp 106 PID 4520 wrote to memory of 4280 4520 C98A.tmp 106 PID 4280 wrote to memory of 2640 4280 CA26.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-02_d393478ec9d6b709ee7a0a8c81772b80_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\BD93.tmp"C:\Users\Admin\AppData\Local\Temp\BD93.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"C:\Users\Admin\AppData\Local\Temp\BFB6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\C071.tmp"C:\Users\Admin\AppData\Local\Temp\C071.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\C18B.tmp"C:\Users\Admin\AppData\Local\Temp\C18B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\C275.tmp"C:\Users\Admin\AppData\Local\Temp\C275.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"C:\Users\Admin\AppData\Local\Temp\C3BD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\C65D.tmp"C:\Users\Admin\AppData\Local\Temp\C65D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"C:\Users\Admin\AppData\Local\Temp\C7A5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"23⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"24⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"25⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"26⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"27⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"C:\Users\Admin\AppData\Local\Temp\CDFE.tmp"28⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"C:\Users\Admin\AppData\Local\Temp\CE9A.tmp"29⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\CF37.tmp"C:\Users\Admin\AppData\Local\Temp\CF37.tmp"30⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"C:\Users\Admin\AppData\Local\Temp\CFC3.tmp"31⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"32⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"33⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"34⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"35⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"36⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"37⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\D32E.tmp"C:\Users\Admin\AppData\Local\Temp\D32E.tmp"38⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\D38C.tmp"C:\Users\Admin\AppData\Local\Temp\D38C.tmp"39⤵
- Executes dropped EXE
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"C:\Users\Admin\AppData\Local\Temp\D3EA.tmp"40⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"41⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"C:\Users\Admin\AppData\Local\Temp\D4C5.tmp"42⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\D532.tmp"C:\Users\Admin\AppData\Local\Temp\D532.tmp"43⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"C:\Users\Admin\AppData\Local\Temp\D5AF.tmp"44⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"45⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\D66A.tmp"C:\Users\Admin\AppData\Local\Temp\D66A.tmp"46⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"C:\Users\Admin\AppData\Local\Temp\D6B9.tmp"47⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\D716.tmp"C:\Users\Admin\AppData\Local\Temp\D716.tmp"48⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\D793.tmp"C:\Users\Admin\AppData\Local\Temp\D793.tmp"49⤵
- Executes dropped EXE
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"50⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\D84F.tmp"C:\Users\Admin\AppData\Local\Temp\D84F.tmp"51⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"C:\Users\Admin\AppData\Local\Temp\D8AD.tmp"52⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"C:\Users\Admin\AppData\Local\Temp\D8FB.tmp"53⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D968.tmp"C:\Users\Admin\AppData\Local\Temp\D968.tmp"54⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"C:\Users\Admin\AppData\Local\Temp\D9D5.tmp"55⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"56⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\DA91.tmp"C:\Users\Admin\AppData\Local\Temp\DA91.tmp"57⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"C:\Users\Admin\AppData\Local\Temp\DAFE.tmp"58⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"59⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"C:\Users\Admin\AppData\Local\Temp\DBAA.tmp"60⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"C:\Users\Admin\AppData\Local\Temp\DBF8.tmp"61⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\DC46.tmp"C:\Users\Admin\AppData\Local\Temp\DC46.tmp"62⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"63⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\DD02.tmp"C:\Users\Admin\AppData\Local\Temp\DD02.tmp"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"C:\Users\Admin\AppData\Local\Temp\DD6F.tmp"65⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"C:\Users\Admin\AppData\Local\Temp\DDDD.tmp"66⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"C:\Users\Admin\AppData\Local\Temp\DE3A.tmp"67⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"C:\Users\Admin\AppData\Local\Temp\DEC7.tmp"68⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\DF25.tmp"C:\Users\Admin\AppData\Local\Temp\DF25.tmp"69⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\DF83.tmp"C:\Users\Admin\AppData\Local\Temp\DF83.tmp"70⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"C:\Users\Admin\AppData\Local\Temp\DFF0.tmp"71⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"72⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"73⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\E128.tmp"C:\Users\Admin\AppData\Local\Temp\E128.tmp"74⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"75⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"76⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\E271.tmp"C:\Users\Admin\AppData\Local\Temp\E271.tmp"77⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"C:\Users\Admin\AppData\Local\Temp\E2CE.tmp"78⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"79⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"80⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"C:\Users\Admin\AppData\Local\Temp\E3E8.tmp"81⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"82⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"C:\Users\Admin\AppData\Local\Temp\E4F1.tmp"84⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"85⤵PID:3668
-
C:\Users\Admin\AppData\Local\Temp\E58D.tmp"C:\Users\Admin\AppData\Local\Temp\E58D.tmp"86⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"C:\Users\Admin\AppData\Local\Temp\E5FB.tmp"87⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\E659.tmp"C:\Users\Admin\AppData\Local\Temp\E659.tmp"88⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"89⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\E714.tmp"C:\Users\Admin\AppData\Local\Temp\E714.tmp"90⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\E762.tmp"C:\Users\Admin\AppData\Local\Temp\E762.tmp"91⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"92⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\E81E.tmp"C:\Users\Admin\AppData\Local\Temp\E81E.tmp"93⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\E88B.tmp"C:\Users\Admin\AppData\Local\Temp\E88B.tmp"94⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"95⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\E947.tmp"C:\Users\Admin\AppData\Local\Temp\E947.tmp"96⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"C:\Users\Admin\AppData\Local\Temp\E9B4.tmp"97⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\EA21.tmp"C:\Users\Admin\AppData\Local\Temp\EA21.tmp"98⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"99⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"C:\Users\Admin\AppData\Local\Temp\EAEC.tmp"100⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"C:\Users\Admin\AppData\Local\Temp\EB5A.tmp"101⤵PID:904
-
C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"C:\Users\Admin\AppData\Local\Temp\EBB8.tmp"102⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"103⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"104⤵
- System Location Discovery: System Language Discovery
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"C:\Users\Admin\AppData\Local\Temp\ECF0.tmp"105⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"C:\Users\Admin\AppData\Local\Temp\ED3E.tmp"106⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"107⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"C:\Users\Admin\AppData\Local\Temp\EDEA.tmp"108⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"109⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\EE86.tmp"C:\Users\Admin\AppData\Local\Temp\EE86.tmp"110⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"C:\Users\Admin\AppData\Local\Temp\EEE4.tmp"111⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\EF32.tmp"C:\Users\Admin\AppData\Local\Temp\EF32.tmp"112⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"C:\Users\Admin\AppData\Local\Temp\EFA0.tmp"113⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"C:\Users\Admin\AppData\Local\Temp\EFEE.tmp"114⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"115⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"C:\Users\Admin\AppData\Local\Temp\F0A9.tmp"116⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\F107.tmp"C:\Users\Admin\AppData\Local\Temp\F107.tmp"117⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\F165.tmp"C:\Users\Admin\AppData\Local\Temp\F165.tmp"118⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"C:\Users\Admin\AppData\Local\Temp\F1C2.tmp"119⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\F230.tmp"C:\Users\Admin\AppData\Local\Temp\F230.tmp"120⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"121⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"C:\Users\Admin\AppData\Local\Temp\F2DC.tmp"122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-