Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/08/2024, 03:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe
Resource
win10v2004-20240802-en
General
-
Target
2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe
-
Size
529KB
-
MD5
8248ae10044c408bcb1be84feaa16f86
-
SHA1
1ec6e6e8f69dd3679112e6b626fde75893ae17ad
-
SHA256
4228d679140ffb079740a006f15fe5ca6f5f7ca6f8effbec0ae674d7a2503412
-
SHA512
c90eb98a53e3964ce468c6e9c3638d477cb9cf49748af34a0ccd9bd4c57dfbf5800551437f12360522497011bdd53fa9b2691ac3d45dfa8e3a71d5d3c93555ed
-
SSDEEP
12288:NU5rCOTeijOsMeOnv6v5dLkGHTZwlH4Hp:NUQOJjOsMe4v6v52GHTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4768 8D8A.tmp 3552 8E17.tmp 1204 8E84.tmp 4856 8F30.tmp 3584 8FAD.tmp 4656 901A.tmp 3468 9078.tmp 4988 90D6.tmp 1744 9134.tmp 1676 91B1.tmp 3408 920E.tmp 464 929B.tmp 3568 92F9.tmp 3536 9357.tmp 3192 93A5.tmp 3532 9412.tmp 552 94AE.tmp 4492 952B.tmp 3104 9599.tmp 1772 95E7.tmp 4460 9635.tmp 2232 96A2.tmp 2428 971F.tmp 2912 976D.tmp 372 97FA.tmp 1860 9858.tmp 3812 98B6.tmp 3964 9933.tmp 4892 9981.tmp 2208 99DE.tmp 2224 9A3C.tmp 2368 9A9A.tmp 5012 9AF8.tmp 3160 9B65.tmp 4116 9BC3.tmp 4128 9C11.tmp 3880 9C5F.tmp 2932 9CAD.tmp 4428 9D0B.tmp 1444 9DA7.tmp 3472 9DF5.tmp 4688 9E53.tmp 2652 9EA1.tmp 4836 9EEF.tmp 4660 9F3D.tmp 2968 9F8C.tmp 3512 9FE9.tmp 800 A037.tmp 4856 A095.tmp 2268 A0E3.tmp 1660 A131.tmp 3348 A180.tmp 4176 A1CE.tmp 2216 A21C.tmp 232 A26A.tmp 2928 A2B8.tmp 4732 A316.tmp 3076 A364.tmp 1480 A3C2.tmp 3896 A410.tmp 464 A46E.tmp 1344 A4CB.tmp 2068 A519.tmp 2372 A568.tmp -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF27.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 4EF6.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5927.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7598.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3718.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C5EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E196.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2AF3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54A3.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BE4A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CF80.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D74.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D01C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B371.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 46C8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AB15.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ABEB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3573.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6954.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5639.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B41D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B6AD.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language E5EB.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F898.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 97FA.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language F4D.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9EA1.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C19A.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language D59F.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 38BE.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3812.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5DCB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5052 wrote to memory of 4768 5052 2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe 85 PID 5052 wrote to memory of 4768 5052 2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe 85 PID 5052 wrote to memory of 4768 5052 2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe 85 PID 4768 wrote to memory of 3552 4768 8D8A.tmp 86 PID 4768 wrote to memory of 3552 4768 8D8A.tmp 86 PID 4768 wrote to memory of 3552 4768 8D8A.tmp 86 PID 3552 wrote to memory of 1204 3552 8E17.tmp 88 PID 3552 wrote to memory of 1204 3552 8E17.tmp 88 PID 3552 wrote to memory of 1204 3552 8E17.tmp 88 PID 1204 wrote to memory of 4856 1204 8E84.tmp 89 PID 1204 wrote to memory of 4856 1204 8E84.tmp 89 PID 1204 wrote to memory of 4856 1204 8E84.tmp 89 PID 4856 wrote to memory of 3584 4856 8F30.tmp 90 PID 4856 wrote to memory of 3584 4856 8F30.tmp 90 PID 4856 wrote to memory of 3584 4856 8F30.tmp 90 PID 3584 wrote to memory of 4656 3584 8FAD.tmp 91 PID 3584 wrote to memory of 4656 3584 8FAD.tmp 91 PID 3584 wrote to memory of 4656 3584 8FAD.tmp 91 PID 4656 wrote to memory of 3468 4656 901A.tmp 92 PID 4656 wrote to memory of 3468 4656 901A.tmp 92 PID 4656 wrote to memory of 3468 4656 901A.tmp 92 PID 3468 wrote to memory of 4988 3468 9078.tmp 93 PID 3468 wrote to memory of 4988 3468 9078.tmp 93 PID 3468 wrote to memory of 4988 3468 9078.tmp 93 PID 4988 wrote to memory of 1744 4988 90D6.tmp 94 PID 4988 wrote to memory of 1744 4988 90D6.tmp 94 PID 4988 wrote to memory of 1744 4988 90D6.tmp 94 PID 1744 wrote to memory of 1676 1744 9134.tmp 95 PID 1744 wrote to memory of 1676 1744 9134.tmp 95 PID 1744 wrote to memory of 1676 1744 9134.tmp 95 PID 1676 wrote to memory of 3408 1676 91B1.tmp 96 PID 1676 wrote to memory of 3408 1676 91B1.tmp 96 PID 1676 wrote to memory of 3408 1676 91B1.tmp 96 PID 3408 wrote to memory of 464 3408 920E.tmp 97 PID 3408 wrote to memory of 464 3408 920E.tmp 97 PID 3408 wrote to memory of 464 3408 920E.tmp 97 PID 464 wrote to memory of 3568 464 929B.tmp 98 PID 464 wrote to memory of 3568 464 929B.tmp 98 PID 464 wrote to memory of 3568 464 929B.tmp 98 PID 3568 wrote to memory of 3536 3568 92F9.tmp 99 PID 3568 wrote to memory of 3536 3568 92F9.tmp 99 PID 3568 wrote to memory of 3536 3568 92F9.tmp 99 PID 3536 wrote to memory of 3192 3536 9357.tmp 100 PID 3536 wrote to memory of 3192 3536 9357.tmp 100 PID 3536 wrote to memory of 3192 3536 9357.tmp 100 PID 3192 wrote to memory of 3532 3192 93A5.tmp 101 PID 3192 wrote to memory of 3532 3192 93A5.tmp 101 PID 3192 wrote to memory of 3532 3192 93A5.tmp 101 PID 3532 wrote to memory of 552 3532 9412.tmp 102 PID 3532 wrote to memory of 552 3532 9412.tmp 102 PID 3532 wrote to memory of 552 3532 9412.tmp 102 PID 552 wrote to memory of 4492 552 94AE.tmp 103 PID 552 wrote to memory of 4492 552 94AE.tmp 103 PID 552 wrote to memory of 4492 552 94AE.tmp 103 PID 4492 wrote to memory of 3104 4492 952B.tmp 104 PID 4492 wrote to memory of 3104 4492 952B.tmp 104 PID 4492 wrote to memory of 3104 4492 952B.tmp 104 PID 3104 wrote to memory of 1772 3104 9599.tmp 105 PID 3104 wrote to memory of 1772 3104 9599.tmp 105 PID 3104 wrote to memory of 1772 3104 9599.tmp 105 PID 1772 wrote to memory of 4460 1772 95E7.tmp 106 PID 1772 wrote to memory of 4460 1772 95E7.tmp 106 PID 1772 wrote to memory of 4460 1772 95E7.tmp 106 PID 4460 wrote to memory of 2232 4460 9635.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-07_8248ae10044c408bcb1be84feaa16f86_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\920E.tmp"C:\Users\Admin\AppData\Local\Temp\920E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\929B.tmp"C:\Users\Admin\AppData\Local\Temp\929B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\92F9.tmp"C:\Users\Admin\AppData\Local\Temp\92F9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\96A2.tmp"C:\Users\Admin\AppData\Local\Temp\96A2.tmp"23⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\971F.tmp"C:\Users\Admin\AppData\Local\Temp\971F.tmp"24⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\976D.tmp"C:\Users\Admin\AppData\Local\Temp\976D.tmp"25⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"26⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:372 -
C:\Users\Admin\AppData\Local\Temp\9858.tmp"C:\Users\Admin\AppData\Local\Temp\9858.tmp"27⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"28⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"29⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\9981.tmp"C:\Users\Admin\AppData\Local\Temp\9981.tmp"30⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"31⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"32⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"33⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"34⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"35⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"36⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"37⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"38⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"39⤵
- Executes dropped EXE
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"C:\Users\Admin\AppData\Local\Temp\9D0B.tmp"40⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\9D59.tmp"C:\Users\Admin\AppData\Local\Temp\9D59.tmp"41⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"42⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"43⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"44⤵
- Executes dropped EXE
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"45⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"46⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"47⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"48⤵
- Executes dropped EXE
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"C:\Users\Admin\AppData\Local\Temp\9FE9.tmp"49⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"50⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\A095.tmp"C:\Users\Admin\AppData\Local\Temp\A095.tmp"51⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"52⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"53⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"54⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"C:\Users\Admin\AppData\Local\Temp\A1CE.tmp"55⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"56⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"57⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"58⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"59⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"60⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"61⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\A410.tmp"C:\Users\Admin\AppData\Local\Temp\A410.tmp"62⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"63⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"64⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"65⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A568.tmp"C:\Users\Admin\AppData\Local\Temp\A568.tmp"66⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"67⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"68⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"69⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"70⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"71⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"72⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"73⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"74⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\A856.tmp"C:\Users\Admin\AppData\Local\Temp\A856.tmp"75⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"76⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"77⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"78⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"79⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"C:\Users\Admin\AppData\Local\Temp\AA1B.tmp"80⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\AA78.tmp"C:\Users\Admin\AppData\Local\Temp\AA78.tmp"81⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"82⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\AB15.tmp"C:\Users\Admin\AppData\Local\Temp\AB15.tmp"83⤵
- System Location Discovery: System Language Discovery
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"84⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"85⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"86⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"87⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"88⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"89⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"90⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"91⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"92⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"93⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"C:\Users\Admin\AppData\Local\Temp\AEDD.tmp"94⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"95⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"96⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"97⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"98⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\B064.tmp"C:\Users\Admin\AppData\Local\Temp\B064.tmp"99⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"100⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"101⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"102⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"103⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\B20A.tmp"C:\Users\Admin\AppData\Local\Temp\B20A.tmp"104⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"105⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"106⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"107⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\B371.tmp"C:\Users\Admin\AppData\Local\Temp\B371.tmp"108⤵
- System Location Discovery: System Language Discovery
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"109⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"110⤵
- System Location Discovery: System Language Discovery
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"111⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"112⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\B517.tmp"C:\Users\Admin\AppData\Local\Temp\B517.tmp"113⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"114⤵PID:1124
-
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"115⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\B611.tmp"C:\Users\Admin\AppData\Local\Temp\B611.tmp"116⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"117⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"C:\Users\Admin\AppData\Local\Temp\B6AD.tmp"118⤵
- System Location Discovery: System Language Discovery
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"119⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"120⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"121⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"C:\Users\Admin\AppData\Local\Temp\B7F6.tmp"122⤵PID:1520
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-